Recent changes to bugs

#121 double spaces are replaced with single space

Helder "Lthere" Magalhães — Tue, 16 Apr 2024 23:54:12 -0000

From tinyxml.h:

    /** The world does not agree on whether white space should be kept or
        not. In order to make everyone happy, these global, static functions
        are provided to set whether or not TinyXml will condense all white space
        into a single space or not. The default is to condense. Note changing this
        value is not thread safe.
    */

So please read the documentation and consider using SetCondenseWhiteSpace to fix this "unexpected" behavior. Please close the issue unless the suggestion doesn't cover your use-case/behavior.

Assertion in TiXmlBase::StringEqual can cause DoS

Nikita — Mon, 17 Jan 2022 09:09:33 -0000

This vulnerability is caused by the following code:

bool TiXmlBase::StringEqual( const char* p,
               const char* tag,
               bool ignoreCase,
               TiXmlEncoding encoding )
{
  assert( p );
  assert( tag );
  if ( !p || !*p )
  {
    assert( 0 );
    return false;
  }

My program for testing:

#include "tinyxml.h"
#include <stdlib.h>
#include <string>

int main(int argc, char*argv[]){
    char buf[10240];

    if(argc < 2){
        printf("args error\n");
        return 0;
    }
    FILE *f = fopen(argv[1], "rb");
    size_t len = fread(buf, 1, sizeof(buf), f);

    std::string s(buf, sizeof(buf));
    TiXmlDocument doc;
    doc.Parse(s.c_str());

    fclose(f);
    return 0;
}

Result:

test_input: tinyxmlparser.cpp:543: static bool TiXmlBase::StringEqual(const char *, const char *, bool, TiXmlEncoding): Assertion `0' failed.
[1]    1843 abort      ./test_input minimized_crash

And I use libfuzzer to get more detailed output:

harness2: tinyxmlparser.cpp:543: static bool TiXmlBase::StringEqual(const char *, const char *, bool, TiXmlEncoding): Assertion `0' failed.
==1849== ERROR: libFuzzer: deadly signal
    #0 0x527e41 in __sanitizer_print_stack_trace (/home/presler/fuzzing/tinyxml/harness2+0x527e41)
    #1 0x472f98 in fuzzer::PrintStackTrace() (/home/presler/fuzzing/tinyxml/harness2+0x472f98)
    #2 0x4580e3 in fuzzer::Fuzzer::CrashCallback() (/home/presler/fuzzing/tinyxml/harness2+0x4580e3)
    #3 0x7f07d48103bf  (/lib/x86_64-linux-gnu/libpthread.so.0+0x153bf)
    #4 0x7f07d462118a in __libc_signal_restore_set /build/glibc-eX1tMB/glibc-2.31/signal/../sysdeps/unix/sysv/linux/internal-signals.h:86:3
    #5 0x7f07d462118a in raise /build/glibc-eX1tMB/glibc-2.31/signal/../sysdeps/unix/sysv/linux/raise.c:48:3
    #6 0x7f07d4600858 in abort /build/glibc-eX1tMB/glibc-2.31/stdlib/abort.c:79:7
    #7 0x7f07d4600728 in __assert_fail_base /build/glibc-eX1tMB/glibc-2.31/assert/assert.c:92:3
    #8 0x7f07d4611f35 in __assert_fail /build/glibc-eX1tMB/glibc-2.31/assert/assert.c:101:3
    #9 0x558e38 in TiXmlBase::StringEqual(char const*, char const*, bool, TiXmlEncoding) /home/presler/fuzzing/tinyxml/tinyxmlparser.cpp:543:3
    #10 0x55b25c in TiXmlDeclaration::Parse(char const*, TiXmlParsingData*, TiXmlEncoding) /home/presler/fuzzing/tinyxml/tinyxmlparser.cpp:1603:8
    #11 0x55a4bc in TiXmlElement::ReadValue(char const*, TiXmlParsingData*, TiXmlEncoding) /home/presler/fuzzing/tinyxml/tinyxmlparser.cpp:1229:16
    #12 0x559e3a in TiXmlElement::Parse(char const*, TiXmlParsingData*, TiXmlEncoding) /home/presler/fuzzing/tinyxml/tinyxmlparser.cpp:1109:8
    #13 0x55949a in TiXmlDocument::Parse(char const*, TiXmlParsingData*, TiXmlEncoding) /home/presler/fuzzing/tinyxml/tinyxmlparser.cpp:759:14
    #14 0x551699 in LLVMFuzzerTestOneInput /home/presler/fuzzing/tinyxml/harness2.cpp:17:9
    #15 0x4597a1 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) (/home/presler/fuzzing/tinyxml/harness2+0x4597a1)
    #16 0x444f12 in fuzzer::RunOneTest(fuzzer::Fuzzer*, char const*, unsigned long) (/home/presler/fuzzing/tinyxml/harness2+0x444f12)
    #17 0x44a9c6 in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) (/home/presler/fuzzing/tinyxml/harness2+0x44a9c6)
    #18 0x473682 in main (/home/presler/fuzzing/tinyxml/harness2+0x473682)
    #19 0x7f07d46020b2 in __libc_start_main /build/glibc-eX1tMB/glibc-2.31/csu/../csu/libc-start.c:308:16
    #20 0x41f5dd in _start (/home/presler/fuzzing/tinyxml/harness2+0x41f5dd)

NOTE: libFuzzer has rudimentary signal handlers.
      Combine libFuzzer with AddressSanitizer or similar for better crash reports.
SUMMARY: libFuzzer: deadly signal

Test case also was attached

#141 TIXML_UTF_LEAD_0 can cause TinyXML DoS

Wang Zhong — Tue, 14 Sep 2021 13:44:56 -0000

\xef\0 can cause TiXmlParsingData::Stamp loop forever, so that I think this can be described as DoS

TIXML_UTF_LEAD_0 can cause TinyXML DoS

Wang Zhong — Tue, 14 Sep 2021 13:41:07 -0000

This vulnerability is caused by the following code(tinyxmlparser.cpp#212L) which has no op to p

while ( p < now )
{
        // Treat p as unsigned, so we have a happy compiler.
        const unsigned char* pU = (const unsigned char*)p;

        // Code contributed by Fletcher Dunn: (modified by lee)
        switch (*pU) {
        // ...
            case TIXML_UTF_LEAD_0:
                if ( encoding == TIXML_ENCODING_UTF8 )
                {
                    if ( *(p+1) && *(p+2) )
                    {
                        // In these cases, don't advance the column. These are
                        // 0-width spaces.
                        if ( *(pU+1)==TIXML_UTF_LEAD_1 && *(pU+2)==TIXML_UTF_LEAD_2 )
                            p += 3; 
                        else if ( *(pU+1)==0xbfU && *(pU+2)==0xbeU )
                            p += 3; 
                        else if ( *(pU+1)==0xbfU && *(pU+2)==0xbfU )
                            p += 3; 
                        else
                            { p +=3; ++col; }   // A normal character.
                    }
                }
                else
                {
                    ++p;
                    ++col;
                }
                break;
                // ...
        }
}

My test program:

#include "tinyxml.h"
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>


int main(int argc, char*argv[]){

    if(argc < 2){
        printf("args error\n");
        return 0;
    }

    int fd = open(argv[1], O_RDWR | O_APPEND);
    if(!fd){
        printf("open failed\n");
        return -1;
    }

    int bytes = 1024 * 1024;
    char *buffer = (char*)malloc(bytes);

    int n = read(fd, buffer, bytes-1);
    printf("read %d bytes\n", n);


    TiXmlDocument doc;
    doc.Parse(buffer);


    close(fd);
    free(buffer);
    return 0;
}

./harness ./test_case

And my test case is in the attachment

Address sanitizer in TiXmlBase::SkipWhiteSpace

Tran Chi Thien — Sun, 01 Mar 2020 08:24:11 -0000

In case of giving string for parsing XML, if there is an "unclosed" element like "<xml search="" "="" for="" parser="" will="" the="">" . While searching, the parser skipps the whitespase with function TiXmlBase::SkipWhiteSpace( const char* p, TiXmlEncoding encoding )</xml>

while ( *p && IsWhiteSpace( *p ) ) ++p;

in the 358 line of this fuction, the cursor reaches outsite the memory of the input string. This causes the address sanitizer.

In case of file input for pasring, everything is ok because the memory is locate 1 byte larger than the size of file.

#112 Whitespace only element

Gina Gorgog — Thu, 12 Dec 2019 11:27:58 -0000

Hello!

I am trying to build an xml message where some tags need to have a value that includes CR LF chars.

I have made the patch change in ReadValue function and I have the following:

TiXmlDocument XMLdoc;
TiXmlPrinter XMLprinter;
TiXmlElement *pRoot, *pData;
TiXmlText *pText;
char XMLBuffer[624] = { 0 };

TiXmlBase::SetCondenseWhiteSpace(false);

pRoot = new TiXmlElement("MyTest");
XMLdoc.LinkEndChild(pRoot);

pData = new TiXmlElement("MyTag");

// Tag Content
char receipt_line[512] = { 0 };
strcpy(receipt_line, "this is line 1");
strcat(receipt_line, ("\x0D\x0A");      
strcat(receipt_line, "this is line 2");

pText = new TiXmlText(receipt_line);
pData->LinkEndChild(pText);
pRoot->LinkEndChild(pData);


/* Save XML to buffer */
XMLprinter.SetIndent("  ");
XMLprinter.SetLineBreak("\x0D\x0A");
XMLdoc.Accept(&XMLprinter);
strncpy(XMLBuffer, XMLprinter.CStr(), sizeof(XMLBuffer) - 1);

XMLdoc.SaveFile("text.xml");

--
What happens in the output file is the following:

The \r\n characters within the tag value are transformed into , while they exist at the end of each line above.
I have also tried to add these characters in the tag value as follows:
"\r\n"
" "
"0x0D0x0A"
" "

No success so far!
I also added the second patch proposed here, still same result.
Any help would be greatly appreciated!

Thank you!

XMLPrinter::ClearBuffer() resets _firstElement

Stephan Friedrichs — Tue, 05 Mar 2019 22:27:54 -0000

XMLPrinter::ClearBuffer sets _ firstElement to true. That leads to the suppression of linebreaks in successive uses of XMLPrinter.

This is relevant when buffering the output of XMLPrinter. In detail: The only way to make XMLPrinter write to an std::ostream while not keeping the entire document in memory is to regularly flush the contents of XMLPrinter::CStr() to the ostream - even when only halfway through the document - followed by a call to XMLPrinter::ClearBuffer().

The solution is to remove the line setting "firstElement = true" in XMLPrinter::ClearBuffer. I'm happy to provide a pull request if you point me to where I can do that.

#137 TinyXml(2.6.2) accepts wrong XML?

marshal banana — Fri, 03 Nov 2017 09:52:58 -0000

Please try:

TiXmlDocument doc1;
const char *ret1 = doc1.Parse(
    "<Wrong />\n"
    "   <Element />\n"
    "</Wrong>\n"
    "\n");

TiXmlDocument doc2;
const char *ret2 = doc2.Parse(
    "<Root>\n"
    "<Wrong />\n"
    "   <Element />\n"
    "</Wrong>\n"
    "</Root>\n"
    "\n");

results ==> 
    ret1 is not NULL.
    ret2 is NULL

TinyXml(2.6.2) accepts wrong XML?

marshal banana — Sat, 28 Oct 2017 05:09:37 -0000

Using TinyXml(2.6.2) TiXmlDocument::Parse(),
it accepts this document without error:

tinyxml.h:353: sanity check wrong way around ?

dcb — Sat, 26 Nov 2016 09:56:37 -0000

[tinyxml.h:353]: (style) Array index 'i' is used before limits check.

Source code is

  for( int i=0; p[i] && i<*length; ++i ) {