aboutsummaryrefslogtreecommitdiffstats
path: root/main/libxml2/CVE-2020-24977.patch
blob: cd348c2aa52f9d00aeb1629aaf351129c7c7489d (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
Found by OSS-Fuzz

diff --git a/xmlschemastypes.c b/xmlschemastypes.c
index ca381d3..dd9eac1 100644
--- a/xmlschemastypes.c
+++ b/xmlschemastypes.c
@@ -3628,6 +3628,8 @@ xmlSchemaCompareDurations(xmlSchemaValPtr x, xmlSchemaValPtr y)
 	minday = 0;
 	maxday = 0;
     } else {
+	if (myear > LONG_MAX / 366)
+  	return -2;
 	maxday = 366 * ((myear + 3) / 4) +
 	         365 * ((myear - 1) % 4);
 	minday = maxday - 1;
@@ -4014,6 +4016,14 @@ xmlSchemaCompareDates (xmlSchemaValPtr x, xmlSchemaValPtr y)
     if ((x == NULL) || (y == NULL))
         return -2;
 
+    if ((x->value.date.year > LONG_MAX / 366) ||
+        (x->value.date.year < LONG_MIN / 366) ||
+        (y->value.date.year > LONG_MAX / 366) ||
+        (y->value.date.year < LONG_MIN / 366)) {
+        /* Possible overflow when converting to days. */
+        return -2;
+    }
+
     if (x->value.date.tz_flag) {
 
         if (!y->value.date.tz_flag) {