Add a check to prevent len from going negative in xmlParseAttValueComplex.

third_party/libxml/src/parser.c

 /*
  * parser.c : an XML 1.0 parser, namespaces and validity support are mostly
  *            implemented on top of the SAX interfaces
  *
  * References:
  *   The XML specification:
  *     http://www.w3.org/TR/REC-xml
  *   Original 1.0 version:
  *     http://www.w3.org/TR/1998/REC-xml-19980210
  *   XML second edition working draft
@@ skipping 3782 matching lines @@
                 if (len > buf_size - 10) {
                     growBuffer(buf, 10);
                 }
             }
             NEXTL(l);
         }
         GROW;
         c = CUR_CHAR(l);
     }
     if ((in_space) && (normalize)) {
-        while (buf[len - 1] == 0x20) len--;
+        while ((len > 0) && (buf[len - 1] == 0x20)) len--;
     }
     buf[len] = 0;
     if (RAW == '<') {
         xmlFatalErr(ctxt, XML_ERR_LT_IN_ATTRIBUTE, NULL);
     } else if (RAW != limit) {
         if ((c != 0) && (!IS_CHAR(c))) {
             xmlFatalErrMsg(ctxt, XML_ERR_INVALID_CHAR,
                            "invalid character in attribute value\n");
         } else {
             xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,
@@ skipping 11044 matching lines @@
     if (stream == NULL) {
         xmlFreeParserInputBuffer(input);
         return (NULL);
     }
     inputPush(ctxt, stream);
     return (xmlDoRead(ctxt, URL, encoding, options, 1));
 }
 
 #define bottom_parser
 #include "elfgcchack.h"