From c0e7929f9c9b61d9cdfdf8cac72c7a902df4744a Mon Sep 17 00:00:00 2001 From: Miguel Company Date: Mon, 20 Jan 2025 08:04:58 +0100 Subject: [PATCH] Fix null-dereference in `parseXMLMemberDynamicType` (#5565) * Refs #22535. Add regression test. Signed-off-by: Miguel Company * Refs #22535. Fix issue. Signed-off-by: Miguel Company --------- Signed-off-by: Miguel Company --- src/cpp/xmlparser/XMLDynamicParser.cpp | 7 +++++++ test/unittest/xmlparser/XMLParserTests.cpp | 1 + test/unittest/xmlparser/regressions/22535_profile_bin.xml | 1 + 3 files changed, 9 insertions(+) create mode 100644 test/unittest/xmlparser/regressions/22535_profile_bin.xml diff --git a/src/cpp/xmlparser/XMLDynamicParser.cpp b/src/cpp/xmlparser/XMLDynamicParser.cpp index abfb976af00..b12ec644821 100644 --- a/src/cpp/xmlparser/XMLDynamicParser.cpp +++ b/src/cpp/xmlparser/XMLDynamicParser.cpp @@ -1428,6 +1428,13 @@ DynamicType::_ref_type XMLParser:: parseXMLMemberDynamicType( { DynamicTypeBuilder::_ref_type inner_builder {factory->create_map_type(key_type, value_type, length)}; + if (!inner_builder) + { + EPROSIMA_LOG_ERROR(XMLPARSER, + "Error parsing map member type: `create_map_type` failed for key=`" << key_type << + "`, value=`" << value_type << "`, length=`" << length << "`."); + return {}; + } std::vector bounds; dimensionsToArrayBounds(memberArray, bounds); DynamicTypeBuilder::_ref_type builder = factory->create_array_type( diff --git a/test/unittest/xmlparser/XMLParserTests.cpp b/test/unittest/xmlparser/XMLParserTests.cpp index eb5f56f534f..b08f1cb3c90 100644 --- a/test/unittest/xmlparser/XMLParserTests.cpp +++ b/test/unittest/xmlparser/XMLParserTests.cpp @@ -86,6 +86,7 @@ TEST_F(XMLParserTests, regressions) EXPECT_EQ(XMLP_ret::XML_ERROR, XMLParser::loadXML("regressions/21856_profile_bin.xml", root)); EXPECT_EQ(XMLP_ret::XML_ERROR, XMLParser::loadXML("regressions/22054_profile_bin.xml", root)); EXPECT_EQ(XMLP_ret::XML_ERROR, XMLParser::loadXML("regressions/22101_profile_bin.xml", root)); + EXPECT_EQ(XMLP_ret::XML_ERROR, XMLParser::loadXML("regressions/22535_profile_bin.xml", root)); Log::Flush(); } diff --git a/test/unittest/xmlparser/regressions/22535_profile_bin.xml b/test/unittest/xmlparser/regressions/22535_profile_bin.xml new file mode 100644 index 00000000000..096e214b223 --- /dev/null +++ b/test/unittest/xmlparser/regressions/22535_profile_bin.xml @@ -0,0 +1 @@ +=>>" />>>" />>€lfil"—™ "Ņž/>>€lfil"—™ "Ņž/>>>" />>>" />>€lfil"—™ "Ņž/>>>" />>>" />>>" />>€lfil"—™ "Ņž/>>€lfil"—™ "Ņž/>>>" />>>" />>€lfil"—™ "Ņž/>>>" />>>>€lfil"—™ "Ņž/>" />>€lfil"Ņž/>" />:trans€>>>€lfil"—™ "Ņž/>" />>€lfil"Ņž/>" />:trans€>>" />>>" />>>" />>>" />>€lfil"—™ "Ņž/>>€lfil"—™ "Ņž/>>>" />>>" />>€lfil"—™ "Ņž/>>>" />>>>€lfil"—™ "Ņž/>" />>€lfil"Ņž/>" />:trans€>>>€lfil"—™ "Ņž/>" />>€lfil"Ņž/>" />:trans€>>" />>€lfil"—™ "Ņž/>>€lfil"—™ "Ņž/>>>" />>>" />>€lfil"—™ "Ņž/>>>" />>>>€lfil"—™ "Ņž/>" />>€lfil"Ņž/>" />:trans€>>>€lfil"—™ "Ņž/>" />>€lfil"Ņž/>" />:trans€>>" />>€lfil"—™ "Ņž/>>€lfil"—™ "Ņž/>>>" />>>" />>€lfil"—™ "Ņž/>>>" />>>>€lfil"—™ "Ņž/>" />>€lfil"Ņž/>" />:trans€>>>€lfil"—™ "Ņž/>" />>€lfil"Ņž/>" />:trans€>€lfil"—™ "Ņž/>>€lfil"—™ "Ņž/>>>" />>>" />>€lfil"—™ "Ņž/>>>" />>>" />>>" />>€lfil"—™ "Ņž/>>€lfil"—™ "Ņž/>>>" />>>" />>€lfil"—™ "Ņž/>>>" />>>>€lfil"—™ "Ņž/>" />>€lfil"Ņž/>" />:trans€>>>€lfil"—™ "Ņž/>" />>€lfil"Ņž/>" />:trans€>>" />>€lfil"—™ "Ņž/>>€lfil"—™ "Ņž/>>>" />>>" />>€lfil"—™ "Ņž/>>>" />>>>€lfil"—™ "Ņž/>" />>€lfil"Ņž/>" />:trans€>>>€lfil"—™ "Ņž/>" />>€lfil"Ņž/>" />:trans€>>" />>€lfil"—™ "Ņž/>>€lfil"—™ "Ņž/>>>" />>>" />>€lfil"—™ "Ņž/>>>" />>>>€lfil"—™ "Ņž/>" />>€lfil"Ņž/>" />:trans€>>>€lfil"—™ "Ņž/>" />>€lfil"Ņž/>" />:trans€/ \ No newline at end of file