CVE-2022-34035 (published 2022-07-18T21:15Z)

HTMLDoc v1.9.12 and below was discovered to contain a heap overflow via e_node htmldoc/htmldoc/html.cxx:588.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-787
cwe_name: Out-of-bounds Write
description: The product writes data past the end, or before the beginning, of the intended buffer.
extended_description: 
            
            
             
			 
         
         

Fix information:
repo_url: https://github.com/michaelrsweet/htmldoc
commit_details: repo_url: https://github.com/michaelrsweet/htmldoc
author: Michael R Sweet
author_date: 2021-05-07 06:42:42-04:00
msg: Fix a crash bug with bogus text (Issue #426)
repository: repo_url: https://github.com/michaelrsweet/htmldoc
repo_name: michaelrsweet/htmldoc
description: HTML Conversion Software
repo_language: C++
owner: michaelrsweet
file_changes: filename: CHANGES.md
change_type: ModificationType.MODIFY
diff: @@ -8,6 +8,7 @@
 - Fixed a crash bug with malformed URIs (Issue #418)
 - Fixed a crash bug with malformed GIF files (Issue #423)
 - Fixed a crash bug with empty titles (Issue #425)
+- Fixed a crash bug with bogus text (Issue #426)
 - Fixed some issues reported by Coverity.
 - Removed the bundled libjpeg, libpng, and zlib.
 

programming_language: Markdown
filename: html.cxx
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,7 @@
 /*
  * HTML exporting functions for HTMLDOC, a HTML document processing program.
  *
- * Copyright 2011-2019 by Michael R Sweet.
+ * Copyright 2011-2021 by Michael R Sweet.
  * Copyright 1997-2010 by Easy Software Products.  All rights reserved.
  *
  * This program is free software.  Distribution and use rights are outlined in
@@ -585,7 +585,7 @@ write_node(FILE   *out,		/* I - Output file */
           for (ptr = t->data; *ptr; ptr ++)
             fputs((char *)iso8859(*ptr), out);
 
-	  if (t->data[strlen((char *)t->data) - 1] == '\n')
+	  if (t->data[0] && t->data[strlen((char *)t->data) - 1] == '\n')
             col = 0;
 	  else
             col += strlen((char *)t->data);

programming_language: C
filename: htmllib.cxx
change_type: ModificationType.MODIFY
diff: @@ -1602,7 +1602,7 @@ write_file(tree_t *t,		/* I - Tree entry */
         for (ptr = t->data; *ptr != '\0'; ptr ++)
           fputs((char *)iso8859(*ptr), fp);
 
-	if (t->data[strlen((char *)t->data) - 1] == '\n')
+	if (t->data[0] && t->data[strlen((char *)t->data) - 1] == '\n')
           col = 0;
 	else
           col += strlen((char *)t->data);

programming_language: C
filename: htmlsep.cxx
change_type: ModificationType.MODIFY
diff: @@ -591,7 +591,7 @@ write_node(FILE   *out,		/* I - Output file */
           for (ptr = t->data; *ptr; ptr ++)
             fputs((char *)iso8859(*ptr), out);
 
-	  if (t->data[strlen((char *)t->data) - 1] == '\n')
+	  if (t->data[0] && t->data[strlen((char *)t->data) - 1] == '\n')
             col = 0;
 	  else
             col += strlen((char *)t->data);

programming_language: C
repo_url: https://github.com/michaelrsweet/htmldoc
commit_details: repo_url: https://github.com/michaelrsweet/htmldoc
author: Michael R Sweet
author_date: 2021-05-07 06:37:23-04:00
msg: Fix a crash bug with empty titles (Issue #425)
repository: repo_url: https://github.com/michaelrsweet/htmldoc
repo_name: michaelrsweet/htmldoc
description: HTML Conversion Software
repo_language: C++
owner: michaelrsweet
file_changes: filename: CHANGES.md
change_type: ModificationType.MODIFY
diff: @@ -7,6 +7,7 @@
 - Fixed crash bugs with bogus table attributes (Issue #416, Issue #417)
 - Fixed a crash bug with malformed URIs (Issue #418)
 - Fixed a crash bug with malformed GIF files (Issue #423)
+- Fixed a crash bug with empty titles (Issue #425)
 - Fixed some issues reported by Coverity.
 - Removed the bundled libjpeg, libpng, and zlib.
 

programming_language: Markdown
filename: htmllib.cxx
change_type: ModificationType.MODIFY
diff: @@ -1,7 +1,7 @@
 /*
  * HTML parsing routines for HTMLDOC, a HTML document processing program.
  *
- * Copyright 2011-2020 by Michael R Sweet.
+ * Copyright 2011-2021 by Michael R Sweet.
  * Copyright 1997-2010 by Easy Software Products.  All rights reserved.
  *
  * This program is free software.  Distribution and use rights are outlined in
@@ -2114,11 +2114,11 @@ htmlGetText(tree_t *t)		/* I - Tree to pick */
     else
       tdata = t->data;
 
-    if (tdata != NULL)
+    tlen = tdata ? strlen((char *)tdata) : 0;
+
+    if (tdata != NULL && tlen > 0)
     {
       // Add the text to this string...
-      tlen = strlen((char *)tdata);
-
       if (s)
         s2 = (uchar *)realloc(s, 1 + slen + tlen);
       else
@@ -2132,12 +2132,12 @@ htmlGetText(tree_t *t)		/* I - Tree to pick */
       memcpy((char *)s + slen, (char *)tdata, tlen);
 
       slen += tlen;
+    }
 
-      if (talloc)
-      {
-	free(talloc);
-	talloc = NULL;
-      }
+    if (talloc)
+    {
+      free(talloc);
+      talloc = NULL;
     }
 
     t = t->next;

programming_language: C
filename: testhtml.cxx
change_type: ModificationType.MODIFY
diff: @@ -200,12 +200,21 @@ static void
 show_tree(tree_t *t,                    /* I - Parent node */
           int    indent)                /* I - Indentation */
 {
+  static const char * const markups[] =
+  {
+    "FILE",
+    "UNKNOWN",
+    "ERROR"
+  };
+
   while (t)
   {
     if (t->markup == MARKUP_NONE)
       printf("%*s\"%s\"\n", indent, "", t->data);
-    else
+    else if (t->markup > MARKUP_NONE)
       printf("%*s%s\n", indent, "", _htmlMarkups[t->markup]);
+    else
+      printf("%*s%s\n", indent, "", markups[t->markup - MARKUP_FILE]);
 
     if (t->child)
       show_tree(t->child, indent + 2);

programming_language: C