integer overflow in xmlFAParseQuantExact

```
xmlregexp.c:5216:12: runtime error: signed integer overflow: 999999999 * 10 cannot be represented in type 'int'
    #0 0x67afd5 in xmlFAParseQuantExact /src/libxml2/xmlregexp.c:5216:12
    #1 0x676f8d in xmlFAParseQuantifier /src/libxml2/xmlregexp.c:5257:8
    #2 0x676885 in xmlFAParsePiece /src/libxml2/xmlregexp.c:5368:5
    #3 0x67637f in xmlFAParseBranch /src/libxml2/xmlregexp.c:5388:11
    #4 0x667c59 in xmlFAParseRegExp /src/libxml2/xmlregexp.c:5427:5
    #5 0x667387 in xmlRegexpCompile /src/libxml2/xmlregexp.c:5519:5
    #6 0x686523 in xmlSchemaCheckFacet /src/libxml2/xmlschemas.c:18765:29
    #7 0x6d71db in xmlSchemaCheckFacetValues /src/libxml2/xmlschemas.c:18881:12
    #8 0x6ca87e in xmlSchemaFixupSimpleTypeStageTwo /src/libxml2/xmlschemas.c:18139:11
    #9 0x68d1df in xmlSchemaFixupComponents /src/libxml2/xmlschemas.c:21113:7
    #10 0x689c61 in xmlSchemaParse /src/libxml2/xmlschemas.c:21387:9
    #11 0x4b4500 in LLVMFuzzerTestOneInput /src/libxml2/fuzz/schema.c:29:19
    #12 0x443681 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerLoop.cpp:556:15
    #13 0x42e2a1 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:292:6
    #14 0x433f5e in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerDriver.cpp:774:9
    #15 0x45e0d2 in main /src/llvm/projects/compiler-rt/lib/fuzzer/FuzzerMain.cpp:19:10
    #16 0x7f03441cb82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
    #17 0x407658 in _start (/out/schema+0x407658)
```

fix:https://gitlab.gnome.org/GNOME/libxml2/-/commit/1e7851b5aea4b2d8b9a6b6c02187fc4786f7a8b7

src-openEuler/libxml2
关闭

内容风险标识

评论 (2)

src-openEuler/libxml2关闭 .gitee-modal { width: 500px !important; }

内容风险标识