Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Avoid crashing when SetText is called with a 2GB large string #990

Merged
merged 2 commits into from
Jul 6, 2024
Merged

Avoid crashing when SetText is called with a 2GB large string #990

merged 2 commits into from
Jul 6, 2024

Commits on Jul 1, 2024

  1. Remove extraneous +x bit from source files

    @jengelh
    jengelh committed Jul 1, 2024
    Configuration menu
    Copy the full SHA
    3a893e5 View commit details
    Browse the repository at this point in the history

  2. Make DynArray support objects larger than 1 gigabyte 

    The expression ``const int newAllocated = cap * 2;`` easily causes
overflow, as soon as the input is 1.0 GiB. This goes unnoticed because
release builds of tinyxml2 do not have active assertions.

The change in commit 9.0.0-20-g8fd6cc6 did not do anything useful;
the signed multiplication overflow (and thus undefined behavior)
still occurs.

Using ``int`` in this class is really archaic, because it limits the
class to a gigabyte even on 64-bit platforms.

The multiplication overflow check also needs to include sizeof(T),
otherwise you can run into unsigned multiplication overflow (defined,
but undesirable) in the memcpy() call.

testcase:

int main()
{
        tinyxml2::XMLDocument doc;
        doc.InsertEndChild(doc.NewDeclaration());
        auto root = doc.NewElement("root");
        size_t sz = 0x80000001;
        auto blank = new char[sz];
        memset(blank, ' ', sz);
        blank[sz-1]='\0';
        root->SetText(blank);
        doc.InsertEndChild(root);
        tinyxml2::XMLPrinter printer(nullptr);
        doc.Print(&printer);
}
    @jengelh
    jengelh committed Jul 1, 2024
    Configuration menu
    Copy the full SHA
    eb3ab0d View commit details
    Browse the repository at this point in the history