Solve fuzz XMLParser Null-dereference (#5668)

* Refs 22843+22844: Regression test Signed-off-by: Juanjo Garcia <juanjosegarcia@eprosima.com> * Refs 22843+22844: Fix Signed-off-by: Juanjo Garcia <juanjosegarcia@eprosima.com> --------- Signed-off-by: Juanjo Garcia <juanjosegarcia@eprosima.com>
eProsima · Mar 5, 2025 · dc26c40 · dc26c40
1 parent b54cb8e
commit dc26c40
Show file tree

Hide file tree

Showing 4 changed files with 15 additions and 1 deletion.
diff --git a/src/cpp/xmlparser/XMLDynamicParser.cpp b/src/cpp/xmlparser/XMLDynamicParser.cpp
@@ -1422,7 +1422,17 @@ DynamicType::_ref_type XMLParser:: parseXMLMemberDynamicType(
 
         if (!isArray)
         {
-            member = factory->create_map_type(key_type, value_type, length)->build();
+            auto temp_map = factory->create_map_type(key_type, value_type, length);
+            if (temp_map)
+            {
+                member = temp_map->build();
+            }
+            else
+            {
+                EPROSIMA_LOG_ERROR(XMLPARSER,
+                        "Error parsing map member with name = " << memberName);
+                return {};
+            }
         }
         else
         {

diff --git a/test/unittest/xmlparser/XMLParserTests.cpp b/test/unittest/xmlparser/XMLParserTests.cpp
@@ -87,6 +87,8 @@ TEST_F(XMLParserTests, regressions)
     EXPECT_EQ(XMLP_ret::XML_ERROR, XMLParser::loadXML("regressions/22054_profile_bin.xml", root));
     EXPECT_EQ(XMLP_ret::XML_ERROR, XMLParser::loadXML("regressions/22101_profile_bin.xml", root));
     EXPECT_EQ(XMLP_ret::XML_ERROR, XMLParser::loadXML("regressions/22535_profile_bin.xml", root));
+    EXPECT_EQ(XMLP_ret::XML_ERROR, XMLParser::loadXML("regressions/22843_profile_bin.xml", root));
+    EXPECT_EQ(XMLP_ret::XML_ERROR, XMLParser::loadXML("regressions/22844_profile_bin.xml", root));
     Log::Flush();
 }