[libxml2] Fix overflow handling in xmlBufBackToBuffer



commit bf2e96173d4f78f564015a925970077501586fbe
Author: Nick Wellnhofer <wellnhofer aevum de>
Date:   Thu Nov 7 12:54:01 2019 +0100

    Fix overflow handling in xmlBufBackToBuffer
    
    Don't overwrite 'use' and 'size' members after clamping to INT_MAX.
    
    Thanks to Ranier Vilela for pointing this out in merge request !56.

 buf.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)
---
diff --git a/buf.c b/buf.c
index d46da365..3b212fcc 100644
--- a/buf.c
+++ b/buf.c
@@ -1233,10 +1233,12 @@ xmlBufBackToBuffer(xmlBufPtr buf) {
          * Keep the buffer but provide a truncated size value.
          */
         xmlBufOverflowError(buf, "Allocated size too big for xmlBuffer");
+        ret->use = (int) buf->use;
         ret->size = INT_MAX;
+    } else {
+        ret->use = (int) buf->use;
+        ret->size = (int) buf->size;
     }
-    ret->use = (int) buf->use;
-    ret->size = (int) buf->size;
     ret->alloc = buf->alloc;
     ret->content = buf->content;
     ret->contentIO = buf->contentIO;


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]