xmlto

#5 double free on invalid input
Closed: Fixed Opened by hanno.

Closed: Fixed
Reopen Issue

Attached file will cause a double free in xmlif.

Address Sanitizer output:
{{{
==10820==ERROR: AddressSanitizer: attempting double-free on 0x60200000efd0 in thread T0:
#0 0x7f0bc9b2847f in __interceptor_free (/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.2/libasan.so.1+0x5747f)
#1 0x407474 in end_attribute /mnt/ram/xmlto/xmlif.l:102
#2 0x407474 in yylex /mnt/ram/xmlto/xmlif.l:211
#3 0x7f0bc9755f9f in __libc_start_main (/lib64/libc.so.6+0x1ff9f)
#4 0x401961 (/mnt/ram/xmlto/xmlif/xmlif+0x401961)

0x60200000efd0 is located 0 bytes inside of 2-byte region [0x60200000efd0,0x60200000efd2)
freed by thread T0 here:
#0 0x7f0bc9b2847f in __interceptor_free (/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.2/libasan.so.1+0x5747f)
#1 0x407474 in end_attribute /mnt/ram/xmlto/xmlif.l:102
#2 0x407474 in yylex /mnt/ram/xmlto/xmlif.l:211

previously allocated by thread T0 here:
#0 0x7f0bc9b286f7 in malloc (/usr/lib/gcc/x86_64-pc-linux-gnu/4.9.2/libasan.so.1+0x576f7)
#1 0x7f0bc97b8299 in strdup (/lib64/libc.so.6+0x82299)
}}}

Found with american fuzzy lop.

attachment
doublefree.xml

Confirmed, attribute should be set to NULL after free to prevent it. Thanks for report,

--- xmlif/xmlif.l (revision 81)
+++ xmlif/xmlif.l (working copy)
@@ -100,6 +100,8 @@

 if (attribute)
free(attribute);
  • attribute=NULL;
    +
    if (!end->up)
    {
    fprintf(stderr,"xmlif: malformed end attribute!\n");

.....Committed revision 82.

Metadata Update from @hanno:
- Issue assigned to ovasik
Metadata
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.