Skip to content

Fix XML parser null-dereference bugs on 2.6.x #6333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
PavelGuzenfeld wants to merge 1 commit into
base: 2.6.x
Choose a base branch
from
Open

Fix XML parser null-dereference bugs on 2.6.x #6333

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 14 additions & 6 deletions src/cpp/rtps/xmlparser/XMLDynamicParser.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -868,17 +868,24 @@ XMLP_ret XMLParser::parseXMLUnionDynamicType(
if (p_element != nullptr)
{
const char* disc = p_element->Attribute(TYPE);
p_dynamictypebuilder_t discriminator = getDiscriminatorTypeBuilder(disc);
if (discriminator == nullptr)
if (disc == nullptr)
{
logError(XMLPARSER,
"Error parsing union discriminator: Only primitive types allowed (found type " << disc << ").");
logError(XMLPARSER, "Error parsing union discriminator: 'type' attribute not found.");
ret = XMLP_ret::XML_ERROR;
}
else
{
p_dynamictypebuilder_t typeBuilder = types::DynamicTypeBuilderFactory::get_instance()->create_union_builder(
discriminator);
p_dynamictypebuilder_t discriminator = getDiscriminatorTypeBuilder(disc);
if (discriminator == nullptr)
{
logError(XMLPARSER,
"Error parsing union discriminator: Only primitive types allowed (found type " << disc << ").");
ret = XMLP_ret::XML_ERROR;
}
else
{
p_dynamictypebuilder_t typeBuilder = types::DynamicTypeBuilderFactory::get_instance()->create_union_builder(
discriminator);
typeBuilder->set_name(name);

uint32_t mId = 0;
Expand Down Expand Up @@ -932,6 +939,7 @@ XMLP_ret XMLParser::parseXMLUnionDynamicType(
types::DynamicTypeBuilderFactory::get_instance()->delete_builder(typeBuilder);
ret = XMLP_ret::XML_ERROR;
}
}
}
}
else
Expand Down
39 changes: 35 additions & 4 deletions src/cpp/rtps/xmlparser/XMLParser.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1511,7 +1511,13 @@ XMLP_ret XMLParser::parseXMLConsumer(

if (p_element != nullptr)
{
std::string classStr = p_element->GetText();
const char* classText = p_element->GetText();
if (classText == nullptr)
{
logError(XMLPARSER, "Error parsing log consumer: <class> element has no text content");
return XMLP_ret::XML_ERROR;
}
std::string classStr = classText;

if (std::strcmp(classStr.c_str(), "StdoutConsumer") == 0)
{
Expand Down Expand Up @@ -1545,7 +1551,15 @@ XMLP_ret XMLParser::parseXMLConsumer(
if (nullptr != (p_auxName = property->FirstChildElement(NAME)))
{
// Get property name
std::string s = p_auxName->GetText();
const char* nameText = p_auxName->GetText();
if (nameText == nullptr)
{
logError(XMLPARSER, "Error parsing StdoutErrConsumer property: <name> has no text content");
ret = XMLP_ret::XML_NOK;
property = property->NextSiblingElement(PROPERTY);
continue;
}
std::string s = nameText;

if (std::strcmp(s.c_str(), "stderr_threshold") == 0)
{
Expand All @@ -1568,7 +1582,16 @@ XMLP_ret XMLParser::parseXMLConsumer(
if (nullptr != (p_auxValue = property->FirstChildElement(VALUE)))
{
// Get property value and use it to set the threshold.
std::string threshold_str = p_auxValue->GetText();
const char* valueText = p_auxValue->GetText();
if (valueText == nullptr)
{
logError(XMLPARSER,
"Error parsing StdoutErrConsumer property: <value> has no text content");
ret = XMLP_ret::XML_NOK;
property = property->NextSiblingElement(PROPERTY);
continue;
}
std::string threshold_str = valueText;
if (std::strcmp(threshold_str.c_str(), "Log::Kind::Error") == 0)
{
threshold = Log::Kind::Error;
Expand Down Expand Up @@ -1625,7 +1648,15 @@ XMLP_ret XMLParser::parseXMLConsumer(
// name - stringType
if (nullptr != (p_auxName = property->FirstChildElement(NAME)))
{
std::string s = p_auxName->GetText();
const char* propNameText = p_auxName->GetText();
if (propNameText == nullptr)
{
logError(XMLPARSER, "Error parsing FileConsumer property: <name> has no text content");
ret = XMLP_ret::XML_NOK;
property = property->NextSiblingElement(PROPERTY);
continue;
}
std::string s = propNameText;

if (std::strcmp(s.c_str(), "filename") == 0)
{
Expand Down
30 changes: 30 additions & 0 deletions src/cpp/rtps/xmlparser/XMLProfileManager.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -521,6 +521,11 @@ XMLP_ret XMLProfileManager::extractParticipantProfile(
std::string profile_name = "";

p_node_participant_t node_part = dynamic_cast<p_node_participant_t>(profile.get());
if (node_part == nullptr)
{
logError(XMLPARSER, "Error adding profile from file '" << filename << "': unexpected node type");
return XMLP_ret::XML_ERROR;
}
node_att_map_cit_t it = node_part->getAttributes().find(PROFILE_NAME);
if (it == node_part->getAttributes().end() || it->second.empty())
{
Expand Down Expand Up @@ -554,6 +559,11 @@ XMLP_ret XMLProfileManager::extractPublisherProfile(
std::string profile_name = "";

p_node_publisher_t node_part = dynamic_cast<p_node_publisher_t>(profile.get());
if (node_part == nullptr)
{
logError(XMLPARSER, "Error adding profile from file '" << filename << "': unexpected node type");
return XMLP_ret::XML_ERROR;
}
node_att_map_cit_t it = node_part->getAttributes().find(PROFILE_NAME);
if (it == node_part->getAttributes().end() || it->second.empty())
{
Expand Down Expand Up @@ -587,6 +597,11 @@ XMLP_ret XMLProfileManager::extractSubscriberProfile(
std::string profile_name = "";

p_node_subscriber_t node_part = dynamic_cast<p_node_subscriber_t>(profile.get());
if (node_part == nullptr)
{
logError(XMLPARSER, "Error adding profile from file '" << filename << "': unexpected node type");
return XMLP_ret::XML_ERROR;
}
node_att_map_cit_t it = node_part->getAttributes().find(PROFILE_NAME);
if (it == node_part->getAttributes().end() || it->second.empty())
{
Expand Down Expand Up @@ -677,6 +692,11 @@ XMLP_ret XMLProfileManager::extractTopicProfile(
std::string profile_name = "";

p_node_topic_t node_topic = dynamic_cast<p_node_topic_t>(profile.get());
if (node_topic == nullptr)
{
logError(XMLPARSER, "Error adding profile from file '" << filename << "': unexpected node type");
return XMLP_ret::XML_ERROR;
}
node_att_map_cit_t it = node_topic->getAttributes().find(PROFILE_NAME);
if (it == node_topic->getAttributes().end() || it->second.empty())
{
Expand Down Expand Up @@ -710,6 +730,11 @@ XMLP_ret XMLProfileManager::extractRequesterProfile(
std::string profile_name = "";

p_node_requester_t node_requester = dynamic_cast<p_node_requester_t>(profile.get());
if (node_requester == nullptr)
{
logError(XMLPARSER, "Error adding profile from file '" << filename << "': unexpected node type");
return XMLP_ret::XML_ERROR;
}
node_att_map_cit_t it = node_requester->getAttributes().find(PROFILE_NAME);
if (it == node_requester->getAttributes().end() || it->second.empty())
{
Expand Down Expand Up @@ -738,6 +763,11 @@ XMLP_ret XMLProfileManager::extractReplierProfile(
std::string profile_name = "";

p_node_replier_t node_replier = dynamic_cast<p_node_replier_t>(profile.get());
if (node_replier == nullptr)
{
logError(XMLPARSER, "Error adding profile from file '" << filename << "': unexpected node type");
return XMLP_ret::XML_ERROR;
}
node_att_map_cit_t it = node_replier->getAttributes().find(PROFILE_NAME);
if (it == node_replier->getAttributes().end() || it->second.empty())
{
Expand Down