use-after-free in __xmlRaiseError()

```
=================================================================
==8==ERROR: AddressSanitizer: heap-use-after-free on address 0x602000003ad0 at pc 0x0000004c828f bp 0x7fff4547b7b0 sp 0x7fff4547af38
READ of size 2 at 0x602000003ad0 thread T0
SCARINESS: 42 (2-byte-read-heap-use-after-free)
    #0 0x4c828e in printf_common(void*, char const*, __va_list_tag*) /src/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:547:9
    #1 0x558a5c in __xmlRaiseError /src/libxml2/error.c:501:9
    #2 0x703f52 in xmlErrValidNode /src/libxml2/valid.c:163:5
    #3 0x73d8d7 in xmlValidateRef /src/libxml2/valid.c:6557:6
    #4 0x73ca67 in xmlWalkValidateList /src/libxml2/valid.c:6604:2
    #5 0xa55f4f in xmlListWalk /src/libxml2/list.c:682:13
    #6 0x73424f in xmlValidateCheckRefCallback /src/libxml2/valid.c:6626:5
    #7 0x6c0645 in stubHashScannerFull /src/libxml2/hash.c:852:5
    #8 0x6c016f in xmlHashScanFull /src/libxml2/hash.c:899:7
    #9 0x6bfbeb in xmlHashScan /src/libxml2/hash.c:868:5
    #10 0x733f3f in xmlValidateDocumentFinal /src/libxml2/valid.c:6674:5
    #11 0x9d32ef in xmlSAX2EndDocument /src/libxml2/SAX2.c:1029:17
    #12 0x618f09 in xmlParseChunk /src/libxml2/parser.c:12342:3
    #13 0x9290ed in xmlTextReaderPushData /src/libxml2/xmlreader.c:935:12
    #14 0x9218fa in xmlTextReaderRead /src/libxml2/xmlreader.c:1395:8
    #15 0x5544bb in LLVMFuzzerTestOneInput /src/libxml2/fuzz/xml.c:73:12
    #16 0x45a361 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:556:15
    #17 0x444f81 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:292:6
    #18 0x44ac3e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:774:9
    #19 0x474db2 in main /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10
    #20 0x7ff9d25b482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #21 0x41e338 in _start (/out/xml+0x41e338)

0x602000003ad0 is located 0 bytes inside of 4-byte region [0x602000003ad0,0x602000003ad4)
freed by thread T0 here:
    #0 0x52190d in __interceptor_free /src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:123:3
    #1 0x953921 in xmlTextReaderFreeProp /src/libxml2/xmlreader.c:311:5
    #2 0x955936 in xmlTextReaderFreePropList /src/libxml2/xmlreader.c:335:9
    #3 0x92aa96 in xmlTextReaderFreeNode /src/libxml2/xmlreader.c:478:2
    #4 0x922c92 in xmlTextReaderRead /src/libxml2/xmlreader.c:1451:3
    #5 0x5544bb in LLVMFuzzerTestOneInput /src/libxml2/fuzz/xml.c:73:12
    #6 0x45a361 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:556:15
    #7 0x444f81 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:292:6
    #8 0x44ac3e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:774:9
    #9 0x474db2 in main /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10
    #10 0x7ff9d25b482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

previously allocated by thread T0 here:
    #0 0x521b8d in malloc /src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
    #1 0x877b9c in xmlStrndup /src/libxml2/xmlstring.c:45:23
    #2 0x877da0 in xmlStrdup /src/libxml2/xmlstring.c:71:12
    #3 0x6745ea in xmlNewPropInternal /src/libxml2/tree.c:1878:25
    #4 0x674f0f in xmlNewNsProp /src/libxml2/tree.c:1975:12
    #5 0x9e17b3 in xmlSAX2AttributeNs /src/libxml2/SAX2.c:2003:12
    #6 0x9e05d1 in xmlSAX2StartElementNs /src/libxml2/SAX2.c:2397:6
    #7 0x9344f9 in xmlTextReaderStartElementNs /src/libxml2/xmlreader.c:753:2
    #8 0x64bdfe in xmlParseStartTag2 /src/libxml2/parser.c:9598:6
    #9 0x61d33c in xmlParseTryOrFinish /src/libxml2/parser.c:11384:14
    #10 0x617a94 in xmlParseChunk /src/libxml2/parser.c:12286:13
    #11 0x9285e5 in xmlTextReaderPushData /src/libxml2/xmlreader.c:893:12
    #12 0x91ff6f in xmlTextReaderRead /src/libxml2/xmlreader.c:1332:12
    #13 0x5544bb in LLVMFuzzerTestOneInput /src/libxml2/fuzz/xml.c:73:12
    #14 0x45a361 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:556:15
    #15 0x444f81 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:292:6
    #16 0x44ac3e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:774:9
    #17 0x474db2 in main /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10
    #18 0x7ff9d25b482f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-use-after-free /src/llvm/projects/compiler-rt/lib/asan/../sanitizer_common/sanitizer_common_interceptors_format.inc:547:9 in printf_common(void*, char const*, __va_list_tag*)
Shadow bytes around the buggy address:
  0x0c047fff8700: fa fa 04 fa fa fa 04 fa fa fa fd fa fa fa fd fa
  0x0c047fff8710: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff8720: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff8730: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff8740: fa fa fd fd fa fa fd fa fa fa fd fd fa fa fd fd
=>0x0c047fff8750: fa fa fd fd fa fa fd fa fa fa[fd]fa fa fa fd fa
  0x0c047fff8760: fa fa fd fa fa fa 04 fa fa fa 04 fa fa fa fd fa
  0x0c047fff8770: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff8780: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff8790: fa fa fd fa fa fa fd fa fa fa fd fa fa fa fd fa
  0x0c047fff87a0: fa fa fd fa fa fa fd fd fa fa fd fa fa fa fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==8==ABORTING
```

upstream fix:
https://gitlab.gnome.org/GNOME/libxml2/-/commit/2af3c2a8b974cb5896cd3beb74561ba979de9f34

src-openEuler/libxml2

内容风险标识

评论 (1)

src-openEuler/libxml2 .gitee-modal { width: 500px !important; }

内容风险标识