heap-use-after-free in xmlParserPrintFileContextInternal

```
==8==ERROR: AddressSanitizer: heap-use-after-free on address 0x621000008d00 at pc 0x0000005573ec bp 0x7ffcddb75d10 sp 0x7ffcddb75d08
READ of size 1 at 0x621000008d00 thread T0
SCARINESS: 40 (1-byte-read-heap-use-after-free)
    #0 0x5573eb in xmlParserPrintFileContextInternal /src/libxml2/error.c:194:10
    #1 0x560811 in xmlReportError /src/libxml2/error.c:406:9
    #2 0x55a7b6 in __xmlRaiseError /src/libxml2/error.c:633:2
    #3 0x743b44 in htmlParseErr /src/libxml2/HTMLparser.c:117:5
    #4 0x760c94 in htmlParseChunk /src/libxml2/HTMLparser.c:6152:7
    #5 0x5543c7 in LLVMFuzzerTestOneInput /src/libxml2/fuzz/html.c:60:5
    #6 0x45a361 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:556:15
    #7 0x444f81 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:292:6
    #8 0x44ac3e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:774:9
    #9 0x474db2 in main /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10
    #10 0x7fa11583782f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #11 0x41e338 in _start (/out/html+0x41e338)

0x621000008d00 is located 0 bytes inside of 4096-byte region [0x621000008d00,0x621000009d00)
freed by thread T0 here:
    #0 0x521ea9 in realloc /src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:164:3
    #1 0x88c292 in xmlBufGrowInternal /src/libxml2/buf.c:486:23
    #2 0x88b30d in xmlBufGrow /src/libxml2/buf.c:515:11
    #3 0xa1e4fd in xmlCharEncInput /src/libxml2/encoding.c:2228:9
    #4 0x6cd031 in xmlParserInputBufferPush /src/libxml2/xmlIO.c:3162:12
    #5 0x760525 in htmlParseChunk /src/libxml2/HTMLparser.c:6126:8
    #6 0x554375 in LLVMFuzzerTestOneInput /src/libxml2/fuzz/html.c:57:9
    #7 0x45a361 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:556:15
    #8 0x444f81 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:292:6
    #9 0x44ac3e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:774:9
    #10 0x474db2 in main /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10
    #11 0x7fa11583782f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

previously allocated by thread T0 here:
    #0 0x521b8d in malloc /src/llvm/projects/compiler-rt/lib/asan/asan_malloc_linux.cpp:145:3
    #1 0x8875ab in xmlBufCreate /src/libxml2/buf.c:137:32
    #2 0x56dbae in xmlSwitchInputEncodingInt /src/libxml2/parserInternals.c:1209:34
    #3 0x56ca65 in xmlSwitchToEncodingInt /src/libxml2/parserInternals.c:1295:12
    #4 0x56e219 in xmlSwitchToEncoding /src/libxml2/parserInternals.c:1323:13
    #5 0x776236 in htmlCurrentChar /src/libxml2/HTMLparser.c:526:17
    #6 0x7581a5 in htmlParseComment /src/libxml2/HTMLparser.c:3323:9
    #7 0x769612 in htmlParseTryOrFinish /src/libxml2/HTMLparser.c:5870:4
    #8 0x760e1c in htmlParseChunk /src/libxml2/HTMLparser.c:6160:5
    #9 0x554375 in LLVMFuzzerTestOneInput /src/libxml2/fuzz/html.c:57:9
    #10 0x45a361 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:556:15
    #11 0x444f81 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:292:6
    #12 0x44ac3e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:774:9
    #13 0x474db2 in main /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10
    #14 0x7fa11583782f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)

SUMMARY: AddressSanitizer: heap-use-after-free /src/libxml2/error.c:194:10 in xmlParserPrintFileContextInternal
Shadow bytes around the buggy address:
  0x0c427fff9150: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff9160: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff9170: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff9180: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c427fff9190: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c427fff91a0:[fd]fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c427fff91b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c427fff91c0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c427fff91d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c427fff91e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x0c427fff91f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
  Shadow gap:              cc
==8==ABORTING
```

fix:https://gitlab.gnome.org/GNOME/libxml2/-/commit/3f18e7486d5feb8ae41911ce3c122e05641a4c3d

src-openEuler/libxml2

内容风险标识

评论 (1)

src-openEuler/libxml2 .gitee-modal { width: 500px !important; }

内容风险标识