Commits on Oct 3, 2022

1. [XERCESC-2241] Fix integer overflows in DFAContentModel class …

   On .xsd files like the following ones (generated by ossfuzz, so broken),
   integer overflows can happen in DFAContentModel::countLeafNodes() and
   DFAContentModel::buildDFA() which can later cause out-of-bounds access.
   
   Found in https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=52025
   
   ```
   <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema"
              xmlns:myns="http://myns"
              targetNamespace="http://myns"
              elementFormDefault="qualified" attributeFormDefault="unqualified">
   
   <xs:element name="main_elt">
     <xs:complexType>
        <xs:sequence>
           <xs:group ref="myns:mygroup" minOccurs="32767" maxOccurs="1"/>
         </xs:sequence>
     </xs:complexType>
   </xs:element>
   
   <xs:group name="mygroup">
     <xs:sequence>
         <!-- related to https://issues.apache.org/jira/browse/XERCESC-1051 -->
         <xs:element name="elt" maxOccurs="33333">
           <xs:complexType>
               <xs:sequence>
    ame="x" type="xs:int" maxOccurs="1"/>
               </xs:sequence>
           </xs:complexType>
         </xs:element>
     </xs:sequence>
   </xs:group>
   
   </xs:schema>
   ```

   

   rouault committed Oct 3, 2022
   Configuration menu

   • View commit details
   • Copy full SHA for d767b91
   • Browse repository at this point

   Copy the full SHA

   d767b91 View commit details

   Browse the repository at this point in the history