CVE-2022-34035: Out-of-bounds Write (CWE-787)
value: HTMLDoc v1.9.12 and below was discovered to contain a heap overflow via e_node htmldoc/htmldoc/html.cxx:588.
CWE description: The product writes data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 7.5
Published: 2022-07-18T21:15Z
Repository: https://github.com/michaelrsweet/htmldoc
Language: Other
Files changed: CHANGES.md, htmldoc/htmllib.cxx, htmldoc/testhtml.cxx
Commit date: 2021-05-07 06:37:23 -0400
Commit message: Fix a crash bug with empty titles (Issue #425)

Diff: diff --git a/CHANGES.md b/CHANGES.md
index 764f436c7..d0d5b32b3 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -5,10 +5,11 @@
 - Fixed a number-up crash bug (Issue #413)
 - Fixed JPEG error handling (Issue #415)
 - Fixed crash bugs with bogus table attributes (Issue #416, Issue #417)
 - Fixed a crash bug with malformed URIs (Issue #418)
 - Fixed a crash bug with malformed GIF files (Issue #423)
+- Fixed a crash bug with empty titles (Issue #425)
 - Fixed some issues reported by Coverity.
 - Removed the bundled libjpeg, libpng, and zlib.
 
 
 # Changes in HTMLDOC v1.9.11
diff --git a/htmldoc/htmllib.cxx b/htmldoc/htmllib.cxx
index 84cd4ff0b..2be77b413 100644
--- a/htmldoc/htmllib.cxx
+++ b/htmldoc/htmllib.cxx
@@ -1,9 +1,9 @@
 /*
  * HTML parsing routines for HTMLDOC, a HTML document processing program.
  *
- * Copyright 2011-2020 by Michael R Sweet.
+ * Copyright 2011-2021 by Michael R Sweet.
  * Copyright 1997-2010 by Easy Software Products.  All rights reserved.
  *
  * This program is free software.  Distribution and use rights are outlined in
  * the file "COPYING".
  */
@@ -2112,15 +2112,15 @@ htmlGetText(tree_t *t)		/* I - Tree to pick */
     if (t->child)
       tdata = talloc = htmlGetText(t->child);
     else
       tdata = t->data;
 
-    if (tdata != NULL)
+    tlen = tdata ? strlen((char *)tdata) : 0;
+
+    if (tdata != NULL && tlen > 0)
     {
       // Add the text to this string...
-      tlen = strlen((char *)tdata);
-
       if (s)
         s2 = (uchar *)realloc(s, 1 + slen + tlen);
       else
         s2 = (uchar *)malloc(1 + tlen);
 
@@ -2130,16 +2130,16 @@ htmlGetText(tree_t *t)		/* I - Tree to pick */
       s = s2;
 
       memcpy((char *)s + slen, (char *)tdata, tlen);
 
       slen += tlen;
+    }
 
-      if (talloc)
-      {
-	free(talloc);
-	talloc = NULL;
-      }
+    if (talloc)
+    {
+      free(talloc);
+      talloc = NULL;
     }
 
     t = t->next;
   }
 
diff --git a/htmldoc/testhtml.cxx b/htmldoc/testhtml.cxx
index e1632bda3..ce3fcf09e 100644
--- a/htmldoc/testhtml.cxx
+++ b/htmldoc/testhtml.cxx
@@ -198,16 +198,25 @@ main(int  argc,			/* I - Number of command-line arguments */
 
 static void
 show_tree(tree_t *t,                    /* I - Parent node */
           int    indent)                /* I - Indentation */
 {
+  static const char * const markups[] =
+  {
+    "FILE",
+    "UNKNOWN",
+    "ERROR"
+  };
+
   while (t)
   {
     if (t->markup == MARKUP_NONE)
       printf("%*s\"%s\"\n", indent, "", t->data);
-    else
+    else if (t->markup > MARKUP_NONE)
       printf("%*s%s\n", indent, "", _htmlMarkups[t->markup]);
+    else
+      printf("%*s%s\n", indent, "", markups[t->markup - MARKUP_FILE]);
 
     if (t->child)
       show_tree(t->child, indent + 2);
 
     t = t->next;

Vulnerable code:  * Copyright 2011-2020 by Michael R Sweet.
    if (tdata != NULL)
      tlen = strlen((char *)tdata);

      if (talloc)
      {
	free(talloc);
	talloc = NULL;
      }
    else
Fixed code: - Fixed a crash bug with empty titles (Issue #425)
 * Copyright 2011-2021 by Michael R Sweet.
    tlen = tdata ? strlen((char *)tdata) : 0;

    if (tdata != NULL && tlen > 0)
    }
    if (talloc)
    {
      free(talloc);
      talloc = NULL;
  static const char * const markups[] =
  {
    "FILE",
    "UNKNOWN",
    "ERROR"
  };

    else if (t->markup > MARKUP_NONE)
    else
      printf("%*s%s\n", indent, "", markups[t->markup - MARKUP_FILE]);