[libxml2] Fix potential infinite loop in xmlStringLenDecodeEntities



commit fb2f518cc61239a4010612c9307a3fd7d13c996c
Author: Nick Wellnhofer <wellnhofer aevum de>
Date:   Sat Jun 10 17:06:16 2017 +0200

    Fix potential infinite loop in xmlStringLenDecodeEntities
    
    Make sure that xmlParseStringPEReference advances the "str" pointer
    even if the parser was stopped. Otherwise xmlStringLenDecodeEntities
    can loop infinitely.

 parser.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)
---
diff --git a/parser.c b/parser.c
index 781aa0c..1e23d26 100644
--- a/parser.c
+++ b/parser.c
@@ -8327,6 +8327,7 @@ xmlParseStringPEReference(xmlParserCtxtPtr ctxt, const xmlChar **str) {
        entity = ctxt->sax->getParameterEntity(ctxt->userData, name);
     if (ctxt->instate == XML_PARSER_EOF) {
        xmlFree(name);
+       *str = ptr;
        return(NULL);
     }
     if (entity == NULL) {


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]