Skip to content

Conversation

@memurro000
Copy link

Fix use-of-uninitialized-value in XML parser

Problem: MemorySanitizer detects use-of-uninitialized-value at line 96 in xml_parser_read_rapidxml.hpp when parsing malformed XML input through GraphML parser (issue #131).

Root cause: The XML parser attempts to read from streams that are in bad state or contain uninitialized data, which leads to undefined behavior in RapidXML.

Solution: Add early stream validation in read_xml_internal():

  • Check stream state with stream.good() before any operations
  • Verify non-empty input with stream.peek() != eof()
  • Throw appropriate xml_parser_error for invalid inputs

Testing: The fix resolves the MemorySanitizer warning while maintaining backward compatibility. Empty streams and bad stream states now throw clear exceptions instead of causing undefined behavior.

Files changed:

  • libs/property_tree submodule updated with the security fix

Fixes: #131

- Add stream state validation before XML parsing
- Check for empty input to prevent uninitialized memory access
- Throw appropriate xml_parser_error for invalid inputs

Fixes: boostorg/boost#1099
@pdimov
Copy link
Member

pdimov commented Nov 20, 2025

I suspect that the actual issue here is #129.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

2 participants