search

cocos2d / cocos2d-x-3rd-party-libs-bin

197 stars 340 forks source link

Buffer out of bounds access through pointer in rapidxml [ASAN] #443

Open stevetranby opened 2 years ago

stevetranby commented 2 years ago

I'm not sure if there's an issue for this, but the check if beyond end of string should be tested before dereferencing the pointer to the buffer.

https://github.com/cocos2d/cocos2d-x-3rd-party-libs-bin/blob/14040dbbcc14c12e5783c43003d9e5890c82de26/rapidxml/rapidxml.hpp#L1424 e.g. (should check if gone past end first, otherwise check if it points to a null terminator \0 character):

//if (*text == 0 || text >= endptr_)
if (text >= endptr_ || *text == 0)
                    break;
dumganhar commented 2 years ago

Yep, I think it should check whether the text pointer is valid first. Otherwise, it will read an invalid byte.