From ece2c79df43091686a538b8231cf387d84bfa60e Mon Sep 17 00:00:00 2001 From: Dave Beckett Date: Fri, 7 Feb 2025 11:38:34 -0800 Subject: [PATCH] Fix Github issue 70 B) Heap read buffer overflow in ntriples bnode (raptor_ntriples_parse_term_internal): Only allow looking at the last character of a bnode ID only if bnode length >0 CVE: CVE-2024-57822 Upstream: https://github.com/dajobe/raptor/commit/ece2c79df43091686a538b8231cf387d84bfa60e Signed-off-by: Titouan Christophe --- src/raptor_ntriples.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/raptor_ntriples.c b/src/raptor_ntriples.c index 3276e790..ecc4247c 100644 --- a/src/raptor_ntriples.c +++ b/src/raptor_ntriples.c @@ -212,7 +212,7 @@ raptor_ntriples_parse_term_internal(raptor_world* world, locator->column--; locator->byte--; } - if(term_class == RAPTOR_TERM_CLASS_BNODEID && dest[-1] == '.') { + if(term_class == RAPTOR_TERM_CLASS_BNODEID && position > 0 && dest[-1] == '.') { /* If bnode id ended on '.' move back one */ dest--;