• Show log

    Commit

  • Hash : 30a6533e
    Author : Nick Wellnhofer
    Date : 2019-03-08T12:15:17

    Fix float casts in xmlXPathSubstringFunction
    
    Rewrite conversion of double to int in xmlXPathSubstringFunction, adding
    range checks to avoid undefined behavior. Make sure to add start and
    length as floating-point numbers before converting to int. Fix a bug
    when rounding negative start indices.
    
    Remove unneeded calls to xmlXPathIs{Inf,NaN} and rely on IEEE math
    instead. Avoid computing the string length. xmlUTF8Strsub works as
    expected if the length of the requested substring exceeds the input.
    
    Found with libFuzzer and UBSan.