File 0001-Make-DocPrinter-support-DynArrays-larger-t... of Package tinyxml2

Overview Repositories Revisions Requests Users Attributes Meta

File 0001-Make-DocPrinter-support-DynArrays-larger-than-2G.patch of Package tinyxml2

From 04bbc06cd0d1fbbcebd91a8cd376a0d3c5b3cb27 Mon Sep 17 00:00:00 2001
From: Jan Engelhardt <jengelh@inai.de>
Date: Wed, 14 Aug 2024 15:19:05 +0200
Subject: [PATCH] Make DocPrinter support DynArrays larger than 2G
References: https://github.com/leethomason/tinyxml2/pull/993

If the DynArray within an XMLPrinter object carries 2 gigabytes of
data or more, XMLPrinter::CStrSize returns a truncated result. If a
program casts this back to size_t without thought, sign extension
leads to bad things(tm).

```c++
int main()
{
	tinyxml2::XMLDocument doc;
	doc.InsertEndChild(doc.NewDeclaration());
	auto root = doc.NewElement("root");
	size_t sz = 0x80000002;
	auto blank = new char[sz];
	memset(blank, ' ', sz);
	blank[sz-1]='\0';
	root->SetText(blank);
	doc.InsertEndChild(root);
	tinyxml2::XMLPrinter printer(nullptr);
	doc.Print(&printer);
	std::string_view sv{printer.CStr(), static_cast<size_t>(printer.CStrSize())};
	// sv.size() is way too big, causing overflows on access
	std::string dup(sv); // boom
}
```

Fixes: 2.0.2-873-geb3ab0d
---
 tinyxml2.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tinyxml2.h b/tinyxml2.h
index d5a3afd..cdd6880 100644
--- a/tinyxml2.h
+++ b/tinyxml2.h
@@ -2314,7 +2314,7 @@ public:
     	of the XML file in memory. (Note the size returned
     	includes the terminating null.)
     */
-    int CStrSize() const {
+    size_t CStrSize() const {
         return _buffer.Size();
     }
     /**
-- 
2.46.0

Places

File 0001-Make-DocPrinter-support-DynArrays-larger-than-2G.patch of Package tinyxml2

Places