fix: NULL dereferences and unchecked allocations parsing index XML

Four defects reachable from a crafted or truncated index while
mounting:
- xml_next_tag passed the node name to strcmp; libxml2 returns NULL
  for some node types. Skip NULL names.
- decode_entry_name wrote to a percent-decode buffer allocated from an
  attacker-controlled length without checking the allocation. Return
  -LTFS_NO_MEMORY instead.
- the glob_patterns array growth assigned realloc straight back and
  dereferenced it; on failure the old pointer leaked and the next
  write dereferenced NULL. Use a temporary and fail cleanly.
- an <xattr> named ltfs.vendor.IBM.immutable or appendonly with an
  empty (self-closing) value set xattr->value to NULL, which was then
  passed to strcmp when deciding the WORM flags, crashing the mount.
  Guard the value.

Author: matejk

src/libltfs/xml_reader.c

@@ -115,7 +115,9 @@ int xml_next_tag(xmlTextReaderPtr reader, const char *containing_name,
 			return ret;
 		*name = (const char *)xmlTextReaderConstName(reader);
 		*type = xmlTextReaderNodeType(reader);
-	} while (strcmp(*name, containing_name) && (*type) != XML_ELEMENT_NODE);
+		/* libxml2 returns a NULL name for some node types; keep reading
+		 * rather than dereferencing NULL in strcmp below. */
+	} while (! *name || (strcmp(*name, containing_name) && (*type) != XML_ELEMENT_NODE));
 
 	return 0;
 }

src/libltfs/xml_reader_libltfs.c

@@ -98,6 +98,10 @@ static int decode_entry_name(char **new_name, const char *name)
 	/* Always, length must be shorter than original but allocate null termination space */
 	len = strlen(name);
 	tmp_name = malloc((len * sizeof(UChar)) + 1);
+	if (! tmp_name) {
+		ltfsmsg(LTFS_ERR, 10001E, "decode_entry_name: tmp_name");
+		return -LTFS_NO_MEMORY;
+	}
 	buf_decode[2] = '\0';
 
 	while (i < len) {
@@ -575,8 +579,15 @@ static int _xml_parse_ip_criteria(xmlTextReaderPtr reader, struct ltfs_index *id
 
 			++num_patterns;
 			/* quite inefficient, but the number of patterns should be small. */
-			idx->original_criteria.glob_patterns = realloc(idx->original_criteria.glob_patterns,
-														   (num_patterns + 1) * sizeof(struct ltfs_name));
+			{
+				struct ltfs_name *new_patterns = realloc(idx->original_criteria.glob_patterns,
+														 (num_patterns + 1) * sizeof(struct ltfs_name));
+				if (! new_patterns) {
+					ltfsmsg(LTFS_ERR, 10001E, "_xml_parse_ip_criteria: glob_patterns");
+					return -LTFS_NO_MEMORY;
+				}
+				idx->original_criteria.glob_patterns = new_patterns;
+			}
 
 			if (_xml_parse_nametype(reader,
 									&idx->original_criteria.glob_patterns[num_patterns - 1],
@@ -863,10 +874,10 @@ static int _xml_parse_one_xattr(xmlTextReaderPtr reader, struct dentry *d)
 	if (xattr) {
 		TAILQ_INSERT_TAIL(&d->xattrlist, xattr, list);
 
-		if (!strcmp(xattr->key.name, "ltfs.vendor.IBM.immutable") && !strcmp(xattr->value, "1") ) {
+		if (xattr->value && !strcmp(xattr->key.name, "ltfs.vendor.IBM.immutable") && !strcmp(xattr->value, "1") ) {
 			d->is_immutable = true;
 		}
-		if (!strcmp(xattr->key.name, "ltfs.vendor.IBM.appendonly") && !strcmp(xattr->value, "1") ) {
+		if (xattr->value && !strcmp(xattr->key.name, "ltfs.vendor.IBM.appendonly") && !strcmp(xattr->value, "1") ) {
 			d->is_appendonly = true;
 		}
 	}