aports/main/libxml2/CVE-2020-24977.patch
2020-09-16 05:41:13 -03:00

31 lines
922 B
Diff

Found by OSS-Fuzz
diff --git a/xmlschemastypes.c b/xmlschemastypes.c
index ca381d3..dd9eac1 100644
--- a/xmlschemastypes.c
+++ b/xmlschemastypes.c
@@ -3628,6 +3628,8 @@ xmlSchemaCompareDurations(xmlSchemaValPtr x, xmlSchemaValPtr y)
minday = 0;
maxday = 0;
} else {
+ if (myear > LONG_MAX / 366)
+ return -2;
maxday = 366 * ((myear + 3) / 4) +
365 * ((myear - 1) % 4);
minday = maxday - 1;
@@ -4014,6 +4016,14 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y)
if ((x == NULL) || (y == NULL))
return -2;
+ if ((x->value.date.year > LONG_MAX / 366) ||
+ (x->value.date.year < LONG_MIN / 366) ||
+ (y->value.date.year > LONG_MAX / 366) ||
+ (y->value.date.year < LONG_MIN / 366)) {
+ /* Possible overflow when converting to days. */
+ return -2;
+ }
+
if (x->value.date.tz_flag) {
if (!y->value.date.tz_flag) {