[libxml2] fix a pair of possible out of array char references



commit 0795348aeb86648723bc391e4d02e20631c10bca
Author: Daniel Veillard <veillard redhat com>
Date:   Sun Jan 22 17:42:35 2012 +0800

    fix a pair of possible out of array char references
    
    When serializing char references back to an character string
    Reported by Abhishek Arya <inferno chromium org>

 xmlsave.c       |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)
---
diff --git a/python/setup.py b/python/setup.py
old mode 100755
new mode 100644
diff --git a/xmlsave.c b/xmlsave.c
index ddf7143..23c3bcc 100644
--- a/xmlsave.c
+++ b/xmlsave.c
@@ -248,7 +248,7 @@ xmlEscapeEntities(unsigned char* out, int *outlen,
 	    /*
 	     * We assume we have UTF-8 input.
 	     */
-	    if (outend - out < 10) break;
+	    if (outend - out < 11) break;
 
 	    if (*in < 0xC0) {
 		xmlSaveErr(XML_SAVE_NOT_UTF8, NULL, NULL);
@@ -2002,7 +2002,7 @@ xmlAttrSerializeTxtContent(xmlBufferPtr buf, xmlDocPtr doc,
             /*
              * We assume we have UTF-8 content.
              */
-            unsigned char tmp[10];
+            unsigned char tmp[12];
             int val = 0, l = 1;
 
             if (base != cur)



[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]