Skip to content

Commit 735a643

Browse files
Solve fuzz XMLParser Null-dereference (#5668) (#5683)
* Refs 22843+22844: Regression test Signed-off-by: Juanjo Garcia <juanjosegarcia@eprosima.com> * Refs 22843+22844: Fix Signed-off-by: Juanjo Garcia <juanjosegarcia@eprosima.com> --------- Signed-off-by: Juanjo Garcia <juanjosegarcia@eprosima.com> (cherry picked from commit dc26c40) Co-authored-by: juanjo4936 <69901369+juanjo4936@users.noreply.github.com>
1 parent 2675bef commit 735a643

File tree

4 files changed

+15
-1
lines changed

4 files changed

+15
-1
lines changed

src/cpp/xmlparser/XMLDynamicParser.cpp

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1422,7 +1422,17 @@ DynamicType::_ref_type XMLParser:: parseXMLMemberDynamicType(
14221422

14231423
if (!isArray)
14241424
{
1425-
member = factory->create_map_type(key_type, value_type, length)->build();
1425+
auto temp_map = factory->create_map_type(key_type, value_type, length);
1426+
if (temp_map)
1427+
{
1428+
member = temp_map->build();
1429+
}
1430+
else
1431+
{
1432+
EPROSIMA_LOG_ERROR(XMLPARSER,
1433+
"Error parsing map member with name = " << memberName);
1434+
return {};
1435+
}
14261436
}
14271437
else
14281438
{

test/unittest/xmlparser/XMLParserTests.cpp

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,8 @@ TEST_F(XMLParserTests, regressions)
8787
EXPECT_EQ(XMLP_ret::XML_ERROR, XMLParser::loadXML("regressions/22054_profile_bin.xml", root));
8888
EXPECT_EQ(XMLP_ret::XML_ERROR, XMLParser::loadXML("regressions/22101_profile_bin.xml", root));
8989
EXPECT_EQ(XMLP_ret::XML_ERROR, XMLParser::loadXML("regressions/22535_profile_bin.xml", root));
90+
EXPECT_EQ(XMLP_ret::XML_ERROR, XMLParser::loadXML("regressions/22843_profile_bin.xml", root));
91+
EXPECT_EQ(XMLP_ret::XML_ERROR, XMLParser::loadXML("regressions/22844_profile_bin.xml", root));
9092
Log::Flush();
9193
}
9294

0 commit comments

Comments
 (0)