c/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2 synced 2025-03-28 21:33:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix sanity check in htmlParseNameComplex

Browse Source 
- (cur - len) can overflow.
- Throw an internal error.

Fixes bug 780077.
This commit is contained in:
Nick Wellnhofer 2017-06-11 12:35:59 +02:00
parent 79c8a6b105
commit f39e3be0dd
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
HTMLparser.c
View File

@ -2528,8 +2528,12 @@ htmlParseNameComplex(xmlParserCtxtPtr ctxt) {
}
}
if (ctxt->input->base > ctxt->input->cur - len)
return(NULL);
if (ctxt->input->cur - ctxt->input->base < len) {
/* Sanity check */
htmlParseErr(ctxt, XML_ERR_INTERNAL_ERROR,
"unexpected change of input buffer", NULL, NULL);
return (NULL);
}
return(xmlDictLookup(ctxt->dict, ctxt->input->cur - len, len));
}