Răsfoiți Sursa

Make DocPrinter support DynArrays larger than 2G

If the DynArray within an XMLPrinter object carries 2 gigabytes of
data or more, XMLPrinter::CStrSize returns a truncated result. If a
program casts this back to size_t without thought, sign extension
leads to bad things(tm).

```c++
int main()
{
	tinyxml2::XMLDocument doc;
	doc.InsertEndChild(doc.NewDeclaration());
	auto root = doc.NewElement("root");
	size_t sz = 0x80000002;
	auto blank = new char[sz];
	memset(blank, ' ', sz);
	blank[sz-1]='\0';
	root->SetText(blank);
	doc.InsertEndChild(root);
	tinyxml2::XMLPrinter printer(nullptr);
	doc.Print(&printer);
	std::string_view sv{printer.CStr(), static_cast<size_t>(printer.CStrSize())};
	// sv.size() is way too big, causing overflows on access
	std::string dup(sv); // boom
}
```

Fixes: 2.0.2-873-geb3ab0d
Jan Engelhardt 1 an în urmă
părinte
comite
04bbc06cd0
1 a modificat fișierele cu 1 adăugiri și 1 ștergeri
  1. 1 1
      tinyxml2.h

+ 1 - 1
tinyxml2.h

@@ -2314,7 +2314,7 @@ public:
     	of the XML file in memory. (Note the size returned
     	of the XML file in memory. (Note the size returned
     	includes the terminating null.)
     	includes the terminating null.)
     */
     */
-    int CStrSize() const {
+    size_t CStrSize() const {
         return _buffer.Size();
         return _buffer.Size();
     }
     }
     /**
     /**