Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[22843]+[22844] Solve fuzz XMLParser Null-dereference (backport #5668) #5684

Open
wants to merge 1 commit into
base: 2.14.x
Choose a base branch
from

Conversation

mergify[bot]
Copy link
Contributor

@mergify mergify bot commented Mar 5, 2025

Description

This PR solves two Null-dereference issues from the XMLParser found in oss-fuzz. Added regression test, and fixed by adding an error message preventing an empty map to be built.

@Mergifyio backport 3.1.x 2.14.x 2.10.x

Contributor Checklist

  • Commit messages follow the project guidelines.

  • The code follows the style guidelines of this project.

  • Tests that thoroughly check the new feature have been added/Regression tests checking the bug and its fix have been added; the added tests pass locally

  • N/A Any new/modified methods have been properly documented using Doxygen.

  • N/A Any new configuration API has an equivalent XML API (with the corresponding XSD extension)

  • Changes are backport compatible: they do NOT break ABI nor change library core behavior.

  • Changes are API compatible.

  • N/A New feature has been added to the versions.md file (if applicable).

  • N/A New feature has been documented/Current behavior is correctly described in the documentation.

  • Applicable backports have been included in the description.

Reviewer Checklist

  • The PR has a milestone assigned.
  • The title and description correctly express the PR's purpose.
  • Check contributor checklist is correct.
  • If this is a critical bug fix, backports to the critical-only supported branches have been requested.
  • Check CI results: changes do not issue any warning.
  • Check CI results: failing tests are unrelated with the changes.

This is an automatic backport of pull request #5668 done by [Mergify](https://mergify.com).

* Refs 22843+22844: Regression test

Signed-off-by: Juanjo Garcia <[email protected]>

* Refs 22843+22844: Fix

Signed-off-by: Juanjo Garcia <[email protected]>

---------

Signed-off-by: Juanjo Garcia <[email protected]>
(cherry picked from commit dc26c40)

# Conflicts:
#	src/cpp/xmlparser/XMLDynamicParser.cpp
#	test/unittest/xmlparser/XMLParserTests.cpp
Copy link
Contributor Author

mergify bot commented Mar 5, 2025

Cherry-pick of dc26c40 has failed:

On branch mergify/bp/2.14.x/pr-5668
Your branch is up to date with 'origin/2.14.x'.

You are currently cherry-picking commit dc26c40e.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	new file:   test/unittest/xmlparser/regressions/22843_profile_bin.xml
	new file:   test/unittest/xmlparser/regressions/22844_profile_bin.xml

Unmerged paths:
  (use "git add/rm <file>..." as appropriate to mark resolution)
	deleted by us:   src/cpp/xmlparser/XMLDynamicParser.cpp
	both modified:   test/unittest/xmlparser/XMLParserTests.cpp

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

@mergify mergify bot added the conflicts Backport PR wich git cherry pick failed label Mar 5, 2025
@juanjo4936 juanjo4936 added this to the v2.14.5 milestone Mar 5, 2025
@juanjo4936 juanjo4936 requested a review from richiprosima March 5, 2025 07:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
conflicts Backport PR wich git cherry pick failed
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant