https://issues.oss-fuzz.com/issues/42516062 https://oss-fuzz.com/testcase-detail/5896441415729152 This can be triggered by using an input of `<sequence><foo/><text/></sequence>` against the harness in https://github.com/google/oss-fuzz/blob/master/projects/bluez/fuzz_xml.c The root cause of the heap-buffer-overflow was incorrect stack management in the SDP XML parser (element_end function) that led to type confusion. When an XML element failed to parse (e.g., an unrecognized tag like <foo/>), its corresponding entry was left on the parser stack because the we returned early if data was NULL. With the input <sequence><foo/><text/></sequence>, <foo/> failed parsing and remained on the stack with a NULL data. Then <text/> was parsed and also remained on the stack because it's only popped if ctx_data->stack_head->next->data != NULL. When </sequence> was encountered, the parser then mistakenly used the data from <text/> (which was now at the top of the stack) as the sequence data. This led to a type confusion: the TEXT data's string pointer (val.str) was interpreted as a sequence pointer (val.dataseq). This pointer pointed to a 1-byte allocation (for the empty string). The code then tried to dereference this pointer as an sdp_data_t struct to calculate the sequence size, leading to the out-of-bounds read. To fix this, in element_end, ensure that the stack is popped even if the element's data failed to parse. This prevents the stack desynchronization. --- src/sdp-xml.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/src/sdp-xml.c b/src/sdp-xml.c index a83dec157..e5b30e885 100644 --- a/src/sdp-xml.c +++ b/src/sdp-xml.c @@ -545,8 +545,15 @@ static void element_end(GMarkupParseContext *context, return; } - if (!ctx_data->stack_head || !ctx_data->stack_head->data) { + if (!ctx_data->stack_head) + return; + + if (!ctx_data->stack_head->data) { DBG("No data for %s", element_name); + + elem = ctx_data->stack_head; + ctx_data->stack_head = ctx_data->stack_head->next; + sdp_xml_data_free(elem); return; } -- 2.51.0.rc0.205.g4a044479a3-goog
