lib/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-10-24 13:33:01 +03:00
Code Activity

Fix sanity check in htmlParseNameComplex

Browse Source 
- (cur - len) can overflow.
- Throw an internal error.

Fixes bug 780077.
This commit is contained in:
Nick Wellnhofer
2017-06-11 12:35:59 +02:00
parent 79c8a6b105
commit f39e3be0dd
1 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
HTMLparser.c
View File

@@ -2528,8 +2528,12 @@ htmlParseNameComplex(xmlParserCtxtPtr ctxt) {
} }
} }
if (ctxt->input->base > ctxt->input->cur - len) if (ctxt->input->cur - ctxt->input->base < len) {
return(NULL); /* Sanity check */
htmlParseErr(ctxt, XML_ERR_INTERNAL_ERROR,
"unexpected change of input buffer", NULL, NULL);
return (NULL);
}
return(xmlDictLookup(ctxt->dict, ctxt->input->cur - len, len)); return(xmlDictLookup(ctxt->dict, ctxt->input->cur - len, len));
} }