commit 1c4ee976132231605c5b07e25bb821e5f82632fe
author Karsten Tausche <karsten@fairphone.com> Fri Sep 08 16:21:44 2023 +0200
committer Karsten Tausche <karsten@fairphone.com> Fri Sep 08 16:21:44 2023 +0200
tree 6c5df62e07baf01dba52e07607f1cf6e9f3b7e55
parent 0b574f6b95f5a68c7905676d65e62c7e22dd23ff
parent c7af843c805dd7dbd3337115a522108be9c2d429

Merge branch 'security-aosp-tm-release' into int/13/fp3

* security-aosp-tm-release:
  malloc-fail: Fix OOB read after xmlRegGetCounter

Change-Id: Ida9fb8d76774284aed72e1d34f939c6e883e5c6e

xmlregexp.c

diff --git a/xmlregexp.c b/xmlregexp.c
index 984c7ac..ce09b22 100644
--- a/xmlregexp.c
+++ b/xmlregexp.c
@@ -1673,6 +1673,8 @@
 			return(-1);
 		    inter = ctxt->state;
 		    counter = xmlRegGetCounter(ctxt);
+                    if (counter < 0)
+                        return(-1);
 		    ctxt->counters[counter].min = atom->min - 1;
 		    ctxt->counters[counter].max = atom->max - 1;
 		    /* count the number of times we see it again */
@@ -1691,6 +1693,8 @@
 		     * epsilon transition.
 		     */
 		    counter = xmlRegGetCounter(ctxt);
+                    if (counter < 0)
+                        return(-1);
 		    ctxt->counters[counter].min = atom->min - 1;
 		    ctxt->counters[counter].max = atom->max - 1;
 		    /* count the number of times we see it again */
@@ -6015,6 +6019,8 @@
      * associate a counter to the transition.
      */
     counter = xmlRegGetCounter(am);
+    if (counter < 0)
+        goto error;
     am->counters[counter].min = min;
     am->counters[counter].max = max;
 
@@ -6034,6 +6040,10 @@
     if (min == 0)
 	xmlFAGenerateEpsilonTransition(am, from, to);
     return(to);
+
+error:
+    xmlRegFreeAtom(atom);
+    return(NULL);
 }
 
 /**
@@ -6081,6 +6091,8 @@
      * associate a counter to the transition.
      */
     counter = xmlRegGetCounter(am);
+    if (counter < 0)
+        goto error;
     am->counters[counter].min = min;
     am->counters[counter].max = max;
 
@@ -6100,6 +6112,10 @@
     if (min == 0)
 	xmlFAGenerateEpsilonTransition(am, from, to);
     return(to);
+
+error:
+    xmlRegFreeAtom(atom);
+    return(NULL);
 }
 
 /**
@@ -6167,6 +6183,8 @@
      * associate a counter to the transition.
      */
     counter = xmlRegGetCounter(am);
+    if (counter < 0)
+        goto error;
     am->counters[counter].min = 1;
     am->counters[counter].max = 1;
 
@@ -6179,6 +6197,10 @@
     xmlRegAtomPush(am, atom);
     am->state = to;
     return(to);
+
+error:
+    xmlRegFreeAtom(atom);
+    return(NULL);
 }
 
 
@@ -6226,6 +6248,8 @@
      * associate a counter to the transition.
      */
     counter = xmlRegGetCounter(am);
+    if (counter < 0)
+        goto error;
     am->counters[counter].min = 1;
     am->counters[counter].max = 1;
 
@@ -6238,6 +6262,10 @@
     xmlRegAtomPush(am, atom);
     am->state = to;
     return(to);
+
+error:
+    xmlRegFreeAtom(atom);
+    return(NULL);
 }
 
 /**