xml BUGFIX proper overflow check

michalvasko · michalvasko · commit 60e72ebad499 · 2026-03-23T13:57:39.000+01:00
diff --git a/src/xml.c b/src/xml.c
@@ -412,7 +412,7 @@ lyxml_parse_value_use_buf(const struct ly_ctx *ctx, const char **in, uint32_t *o
     }
 
     /* overflow check */
-    req_size = *len + *offset + need_space;
+    req_size = (uint64_t)*len + (uint64_t)*offset + (uint64_t)need_space;
     if (req_size > UINT32_MAX) {
         LOGVAL(ctx, NULL, LYVE_SYNTAX, "XML value too long.");
         return LY_EINVAL;

Original file line number	Diff line number	Diff line change
`@@ -412,7 +412,7 @@ lyxml_parse_value_use_buf(const struct ly_ctx ctx, const char in, uint32_t o`
`412`	`412`	`}`
`413`	`413`
`414`	`414`	`/* overflow check */`
`415`		`- req_size = len + offset + need_space;`
	`415`	`+ req_size = (uint64_t)len + (uint64_t)offset + (uint64_t)need_space;`
`416`	`416`	`if (req_size > UINT32_MAX) {`
`417`	`417`	`LOGVAL(ctx, NULL, LYVE_SYNTAX, "XML value too long.");`
`418`	`418`	`return LY_EINVAL;`