Attempt to address libxml crash.

third_party/libxml/src/globals.c

 /*
  * globals.c: definition and handling of the set of global variables
  *            of the library
  *
  * The bottom of this file is automatically generated by build_glob.py
  * based on the description file global.data
  *
  * See Copyright for the status of this software.
  *
  * Gary Pennington <Gary.Pennington@uk.sun.com>
@@ skipping 68 matching lines @@
 #undef  xmlMemStrdup
 #undef  xmlRealloc
 
 #if defined(DEBUG_MEMORY_LOCATION) || defined(DEBUG_MEMORY)
 xmlFreeFunc xmlFree = (xmlFreeFunc) xmlMemFree;
 xmlMallocFunc xmlMalloc = (xmlMallocFunc) xmlMemMalloc;
 xmlMallocFunc xmlMallocAtomic = (xmlMallocFunc) xmlMemMalloc;
 xmlReallocFunc xmlRealloc = (xmlReallocFunc) xmlMemRealloc;
 xmlStrdupFunc xmlMemStrdup = (xmlStrdupFunc) xmlMemoryStrdup;
 #else
+
+#define MAX_LIBXML_MALLOC (1024*1024*512)
+
+static void* size_checked_malloc(size_t size) {
+  if (size > MAX_LIBXML_MALLOC) {
+    *(volatile char*)0 = '\0';
+    return NULL;
+  }
+  return malloc(size);
+}
+
+static void* size_checked_realloc(void* ptr, size_t size) {
+  if (size > MAX_LIBXML_MALLOC) {
+    *(volatile char*)0 = '\0';
+    return NULL;
+  }
+  return realloc(ptr, size);
+}
+
 /**
  * xmlFree:
  * @mem: an already allocated block of memory
  *
  * The variable holding the libxml free() implementation
  */
 xmlFreeFunc xmlFree = (xmlFreeFunc) free;
 /**
  * xmlMalloc:
  * @size:  the size requested in bytes
  *
  * The variable holding the libxml malloc() implementation
  *
  * Returns a pointer to the newly allocated block or NULL in case of error
  */
-xmlMallocFunc xmlMalloc = (xmlMallocFunc) malloc;
+xmlMallocFunc xmlMalloc = (xmlMallocFunc) size_checked_malloc;
 /**
  * xmlMallocAtomic:
  * @size:  the size requested in bytes
  *
  * The variable holding the libxml malloc() implementation for atomic
  * data (i.e. blocks not containings pointers), useful when using a
  * garbage collecting allocator.
  *
  * Returns a pointer to the newly allocated block or NULL in case of error
  */
-xmlMallocFunc xmlMallocAtomic = (xmlMallocFunc) malloc;
+xmlMallocFunc xmlMallocAtomic = (xmlMallocFunc) size_checked_malloc;
 /**
  * xmlRealloc:
  * @mem: an already allocated block of memory
  * @size:  the new size requested in bytes
  *
  * The variable holding the libxml realloc() implementation
  *
  * Returns a pointer to the newly reallocated block or NULL in case of error
  */
-xmlReallocFunc xmlRealloc = (xmlReallocFunc) realloc;
+xmlReallocFunc xmlRealloc = (xmlReallocFunc) size_checked_realloc;
 /**
  * xmlMemStrdup:
  * @str: a zero terminated string
  *
  * The variable holding the libxml strdup() implementation
  *
  * Returns the copy of the string or NULL in case of error
  */
 xmlStrdupFunc xmlMemStrdup = (xmlStrdupFunc) xmlStrdup;
 #endif /* DEBUG_MEMORY_LOCATION || DEBUG_MEMORY */
@@ skipping 969 matching lines @@
 xmlOutputBufferCreateFilenameFunc *
 __xmlOutputBufferCreateFilenameValue(void) {
     if (IS_MAIN_THREAD)
         return (&xmlOutputBufferCreateFilenameValue);
     else
         return (&xmlGetGlobalState()->xmlOutputBufferCreateFilenameValue);
 }
 
 #define bottom_globals
 #include "elfgcchack.h"