xmlproc: fix buffer enlargement logic

This fixes a heap buffer overflow caught by the xmlproc fuzzer.

diff --git a/include/wimlib/compiler.h b/include/wimlib/compiler.h
index 2f7125450d4d6fc3852b965ffa3b0d746cd72a16..77cd27f8864ebfe0bdc0b6a4f5fc322647556ca7 100644 (file)
--- a/include/wimlib/compiler.h
+++ b/include/wimlib/compiler.h
@@ -122,6 +122,10 @@
 #undef MAX
 #define MAX(a, b)      max((a), (b))
 
+/* Get the maximum of three variables, without multiple evaluation.  */
+#undef max3
+#define max3(a, b, c)  max(max((a), (b)), (c))
+
 /* Swap the values of two variables, without multiple evaluation.  */
 #ifndef swap
 #  define swap(a, b) ({ typeof(a) _a = (a); (a) = (b); (b) = _a; })

diff --git a/src/xmlproc.c b/src/xmlproc.c
index 6e1d2c168f4f7bd968a0c3ffaa434fb6161265f4..8ce193e93028045716f090233f028ce93a67d359 100644 (file)
--- a/src/xmlproc.c
+++ b/src/xmlproc.c
@@ -665,7 +665,8 @@ static void
 xml_write(struct xml_out_buf *buf, const tchar *str, size_t len)
 {
        if (buf->count + len + 1 > buf->capacity) {
-               size_t new_capacity = max(buf->capacity * 2, 4096);
+               size_t new_capacity = max3(buf->count + len + 1,
+                                          buf->capacity * 2, 4096);
                tchar *new_buf = REALLOC(buf->buf,
                                         new_capacity * sizeof(str[0]));
                if (!new_buf) {