[XERCESC-2085] Crash in PSVIWriter due to strrchr returning NULL

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 3.1.0, 3.1.1, 3.1.2, 3.1.3, 3.1.4
• Fix Version/s: 3.2.0
• Component/s: Samples/Tests
• Environment: Debian GNU/Linux amd64
• Assignee: Scott Cantor
• Reporter: Bill Blough
• Created: 12/Dec/16 22:36
• Updated: 28/Aug/17 23:41
• Resolved: 07/Jul/17 21:25

Description

This was reported in Debian quite some time ago (I was not maintainer then). I have fixed it in Debian and am forwarding my patch.

The original Debian bug report can be found at https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=715592

PSVIWriter uses strrchr but does not properly handle a NULL return value, causing strcat to attempt to dereference a NULL pointer.

My patch adds a check that the result of strrchr (for the '/' case) is not null before executing the strcat. The case for '
' is not affected because of the "greater than" check just prior.