[XERCESC-1081] Array Bound Read, causing inconsistent segmentation violation in XMLFormatter::formatBuf

• Type: Bug
• Status: Closed
• Resolution: Fixed
• Affects Version/s: 2.3.0
• Fix Version/s: 2.4.0
• Component/s: Utilities
• Environment: Operating System: All; Platform: All
• Bugzilla Id: 25218
• Assignee: Unassigned
• Reporter: Jeroen Dirks
• Created: 05/Dec/03 02:25
• Updated: 12/Mar/18 03:54
• Resolved: 09/Apr/04 16:47

Description

from XMLFormatter.cpp, line 363

when tmpPtr == endPtr it still gets dereferenced:

while (!inEscapeList(actualEsc, *tmpPtr) && (tmpPtr < endPtr))
tmpPtr++;

this should have been:

while ((tmpPtr < endPtr)) && !inEscapeList(actualEsc, *tmpPtr))
tmpPtr++;

It shows up as an array bound read in Purify when the array of characters is
not null terminated.
This is very evil since it will only cause a problem if the string was
allocated at the very end of the free store.