Skip to content

Conversation

@memurro000
Copy link

Fix use-of-uninitialized-value in XML parser

Problem: MemorySanitizer detects use-of-uninitialized-value at line 96 in xml_parser_read_rapidxml.hpp when parsing malformed XML input through GraphML parser (issue boostorg/property_tree#131).

Root cause: The XML parser attempts to read from streams that are in bad state or contain uninitialized data, which leads to undefined behavior in RapidXML.

Solution: Add early stream validation in read_xml_internal():

  • Check stream state with stream.good() before any operations
  • Verify non-empty input with stream.peek() != eof()
  • Throw appropriate xml_parser_error for invalid inputs

Testing: The fix resolves the MemorySanitizer warning while maintaining backward compatibility. Empty streams and bad stream states now throw clear exceptions instead of causing undefined behavior.

Files changed:

  • libs/property_tree submodule updated with the security fix

Fixes: boostorg/property_tree#131

This updates the property_tree submodule to include the fix for
use-of-uninitialized-value in xml_parser_read_rapidxml.hpp

The fix adds proper stream validation before XML parsing.
@pdimov
Copy link
Member

pdimov commented Nov 20, 2025

This fix needs to be applied in boostorg/property_tree, not here. Submodules are updated automatically by a script.

@memurro000 memurro000 closed this Nov 20, 2025
@memurro000
Copy link
Author

The fix as requested has been moved to:
boostorg/property_tree#132

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants