a2bd8e17dc
CVE-2011-0216 - Off-by-one error CVE-2011-2821 - Double free vulnerability CVE-2011-2834 - Double free vulnerability CVE-2011-3905 - DOS (out-of-bounds read) via unspecified vectors CVE-2011-3919 - Heap-based buffer overflow ok sthen@
28 lines
1.0 KiB
Plaintext
28 lines
1.0 KiB
Plaintext
$OpenBSD: patch-encoding_c,v 1.1 2012/01/23 10:17:49 ajacoutot Exp $
|
|
|
|
From 69f04562f75212bfcabecd190ea8b06ace28ece2 Mon Sep 17 00:00:00 2001
|
|
From: Daniel Veillard <veillard@redhat.com>
|
|
Date: Fri, 19 Aug 2011 03:05:04 +0000
|
|
Subject: Fix an off by one error in encoding
|
|
|
|
--- encoding.c.orig Thu Nov 4 17:40:06 2010
|
|
+++ encoding.c Mon Jan 23 08:06:05 2012
|
|
@@ -1928,7 +1928,7 @@ xmlCharEncFirstLineInt(xmlCharEncodingHandler *handler
|
|
if (in == NULL) return(-1);
|
|
|
|
/* calculate space available */
|
|
- written = out->size - out->use;
|
|
+ written = out->size - out->use - 1; /* count '\0' */
|
|
toconv = in->use;
|
|
/*
|
|
* echo '<?xml version="1.0" encoding="UCS4"?>' | wc -c => 38
|
|
@@ -2059,7 +2059,7 @@ xmlCharEncInFunc(xmlCharEncodingHandler * handler, xml
|
|
toconv = in->use;
|
|
if (toconv == 0)
|
|
return (0);
|
|
- written = out->size - out->use;
|
|
+ written = out->size - out->use -1; /* count '\0' */
|
|
if (toconv * 2 >= written) {
|
|
xmlBufferGrow(out, out->size + toconv * 2);
|
|
written = out->size - out->use - 1;
|