[libxml2/ddkilzer/oss-fuzz-44803-integer-overflow-in-xmlSkipBlankChars: 3/3] Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars()

[David Kilzer <ddkilzer src gnome org>]

commit 1246459db4918e4f64c952584d5e9382277f5a7e
Author: David Kilzer <ddkilzer webkit org>
Date:   Fri Apr 8 12:33:17 2022 -0700

    Prevent integer-overflow in htmlSkipBlankChars() and xmlSkipBlankChars()
    
    * HTMLparser.c:
    (htmlSkipBlankChars):
    * parser.c:
    (xmlSkipBlankChars):
    - Switch `res` from `int` to `size_t`, then cap the return value
      at INT_MAX.
    - The commit range that OSS-Fuzz listed for the fix didn't make
      any changes to xmlSkipBlankChars(), so it seems like this
      issue may still exist.
    
    Found by OSS-Fuzz Issue 44803.

 HTMLparser.c |  7 ++++---
 parser.c     | 10 ++++++----
 2 files changed, 10 insertions(+), 7 deletions(-)
---
diff --git a/HTMLparser.c b/HTMLparser.c
index 9bd0fb34..7677af1f 100644
--- a/HTMLparser.c
+++ b/HTMLparser.c
@@ -584,7 +584,7 @@ encoding_error:
 
 static int
 htmlSkipBlankChars(xmlParserCtxtPtr ctxt) {
-    int res = 0;
+    size_t res = 0;
 
     while (IS_BLANK_CH(*(ctxt->input->cur))) {
        if ((*ctxt->input->cur == 0) &&
@@ -598,9 +598,10 @@ htmlSkipBlankChars(xmlParserCtxtPtr ctxt) {
            if (*ctxt->input->cur == 0)
                xmlParserInputGrow(ctxt->input, INPUT_CHUNK);
        }
-       res++;
+       if (res < INT_MAX)
+           res++;
     }
-    return(res);
+    return((int)res);
 }
 
 
diff --git a/parser.c b/parser.c
index 230872f4..42aeb33c 100644
--- a/parser.c
+++ b/parser.c
@@ -2182,7 +2182,7 @@ static void xmlGROW (xmlParserCtxtPtr ctxt) {
 
 int
 xmlSkipBlankChars(xmlParserCtxtPtr ctxt) {
-    int res = 0;
+    size_t res = 0;
 
     /*
      * It's Okay to use CUR/NEXT here since all the blanks are on
@@ -2202,7 +2202,8 @@ xmlSkipBlankChars(xmlParserCtxtPtr ctxt) {
                ctxt->input->col++;
            }
            cur++;
-           res++;
+           if (res < INT_MAX)
+               res++;
            if (*cur == 0) {
                ctxt->input->cur = cur;
                xmlParserInputGrow(ctxt->input, INPUT_CHUNK);
@@ -2238,10 +2239,11 @@ xmlSkipBlankChars(xmlParserCtxtPtr ctxt) {
              * by the attachment of one leading and one following space (#x20)
              * character."
              */
-           res++;
+           if (res < INT_MAX)
+               res++;
         }
     }
-    return(res);
+    return((int)res);
 }
 
 /************************************************************************