40 lines
1.2 KiB
Plaintext
40 lines
1.2 KiB
Plaintext
$OpenBSD: patch-SAX2_c,v 1.1 2008/11/23 18:49:42 naddy Exp $
|
|
--- SAX2.c.orig Fri Jan 25 14:10:04 2008
|
|
+++ SAX2.c Sun Nov 23 18:24:46 2008
|
|
@@ -11,6 +11,7 @@
|
|
#include "libxml.h"
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
+#include <limits.h>
|
|
#include <libxml/xmlmemory.h>
|
|
#include <libxml/tree.h>
|
|
#include <libxml/parser.h>
|
|
@@ -26,6 +27,11 @@
|
|
#include <libxml/HTMLtree.h>
|
|
#include <libxml/globals.h>
|
|
|
|
+/* Define SIZE_T_MAX unless defined through <limits.h>. */
|
|
+#ifndef SIZE_T_MAX
|
|
+# define SIZE_T_MAX ((size_t)-1)
|
|
+#endif /* !SIZE_T_MAX */
|
|
+
|
|
/* #define DEBUG_SAX2 */
|
|
/* #define DEBUG_SAX2_TREE */
|
|
|
|
@@ -2445,9 +2451,14 @@ xmlSAX2Characters(void *ctx, const xmlChar *ch, int le
|
|
(xmlDictOwns(ctxt->dict, lastChild->content))) {
|
|
lastChild->content = xmlStrdup(lastChild->content);
|
|
}
|
|
+ if ((size_t)ctxt->nodelen > SIZE_T_MAX - (size_t)len ||
|
|
+ (size_t)ctxt->nodemem + (size_t)len > SIZE_T_MAX / 2) {
|
|
+ xmlSAX2ErrMemory(ctxt, "xmlSAX2Characters overflow prevented");
|
|
+ return;
|
|
+ }
|
|
if (ctxt->nodelen + len >= ctxt->nodemem) {
|
|
xmlChar *newbuf;
|
|
- int size;
|
|
+ size_t size;
|
|
|
|
size = ctxt->nodemem + len;
|
|
size *= 2;
|