From b9da8bcc7854cfb950d7db2e35fec808eea12e46 Mon Sep 17 00:00:00 2001
From: mohammadmseet-hue <mohammadmseet@gmail.com>
Date: Thu, 16 Apr 2026 02:54:30 +0200
Subject: [PATCH] fix: add length check to xmlURIEscapeStr in uri.c

Commit 538b2e38 fixed xmlBuildRelativeURISafe for the pattern where
xmlStrlen() returns 0 for strings longer than INT_MAX, but
xmlURIEscapeStr was not fixed. Without the check, len = 0 + 20, and
the write loop eventually overflows via int wrapping of the out counter.

Add a return NULL guard when xmlStrlen returns 0.
---
 uri.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/uri.c b/uri.c
index 15cb92b37..14ad94eca 100644
--- a/uri.c
+++ b/uri.c
@@ -1644,6 +1644,8 @@ xmlURIEscapeStr(const xmlChar *str, const xmlChar *list) {
     if (str[0] == 0)
 	return(xmlStrdup(str));
     len = xmlStrlen(str);
+    if (len == 0)
+        return(NULL);
 
     len += 20;
     ret = xmlMalloc(len);