Hash :
30a6533e
Author :
Date :
2019-03-08T12:15:17
Fix float casts in xmlXPathSubstringFunction
Rewrite conversion of double to int in xmlXPathSubstringFunction, adding
range checks to avoid undefined behavior. Make sure to add start and
length as floating-point numbers before converting to int. Fix a bug
when rounding negative start indices.
Remove unneeded calls to xmlXPathIs{Inf,NaN} and rely on IEEE math
instead. Avoid computing the string length. xmlUTF8Strsub works as
expected if the length of the requested substring exceeds the input.
Found with libFuzzer and UBSan.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38
string(5)
string(0.5)
string(-0.5)
string(true())
string(false())
string(12345678901234567890)
string(-12345678901234567890)
concat("titi","toto")
concat("titi","toto","tata")
concat("titi",'toto')
concat("titi",'toto',"tata","last")
starts-with("tititoto","titi")
starts-with("tititoto","to")
contains("tititototata","titi")
contains("tititototata","toto")
contains("tititototata","tata")
contains("tititototata","tita")
substring("12345",2,3)
substring("12345",2)
substring("12345",-4)
substring("12345",3.4)
substring("12345",3.6)
substring("12345",1.5,2.6)
substring("12345",2.2,2.2)
substring("12345",0,3)
substring("12345",-8,10)
substring("12345",4,-10)
substring("12345",0 div 0, 3)
substring("12345",1, 0 div 0)
substring("12345",1 div 0, 3)
substring("12345",3,-1 div 0)
substring("12345",-42, 1 div 0)
substring("12345",-1 div 0, 1 div 0)
substring("12345",-1 div 0,5)
substring("12345",-0.7,4)
substring("12345",-5000000000,5000000004)
string-length("")
string-length("titi")