Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(61)

Side by Side Diff: third_party/libxml/src/parser.c

Issue 11343029: Add a check to prevent len from going negative in xmlParseAttValueComplex. (Closed) Base URL: svn://svn.chromium.org/chrome/trunk/src
Patch Set: Created 8 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch | Annotate | Revision Log
« no previous file with comments | « third_party/libxml/README.chromium ('k') | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 /* 1 /*
2 * parser.c : an XML 1.0 parser, namespaces and validity support are mostly 2 * parser.c : an XML 1.0 parser, namespaces and validity support are mostly
3 * implemented on top of the SAX interfaces 3 * implemented on top of the SAX interfaces
4 * 4 *
5 * References: 5 * References:
6 * The XML specification: 6 * The XML specification:
7 * http://www.w3.org/TR/REC-xml 7 * http://www.w3.org/TR/REC-xml
8 * Original 1.0 version: 8 * Original 1.0 version:
9 * http://www.w3.org/TR/1998/REC-xml-19980210 9 * http://www.w3.org/TR/1998/REC-xml-19980210
10 * XML second edition working draft 10 * XML second edition working draft
(...skipping 3782 matching lines...) Expand 10 before | Expand all | Expand 10 after
3793 if (len > buf_size - 10) { 3793 if (len > buf_size - 10) {
3794 growBuffer(buf, 10); 3794 growBuffer(buf, 10);
3795 } 3795 }
3796 } 3796 }
3797 NEXTL(l); 3797 NEXTL(l);
3798 } 3798 }
3799 GROW; 3799 GROW;
3800 c = CUR_CHAR(l); 3800 c = CUR_CHAR(l);
3801 } 3801 }
3802 if ((in_space) && (normalize)) { 3802 if ((in_space) && (normalize)) {
3803 while (buf[len - 1] == 0x20) len--; 3803 while ((len > 0) && (buf[len - 1] == 0x20)) len--;
3804 } 3804 }
3805 buf[len] = 0; 3805 buf[len] = 0;
3806 if (RAW == '<') { 3806 if (RAW == '<') {
3807 xmlFatalErr(ctxt, XML_ERR_LT_IN_ATTRIBUTE, NULL); 3807 xmlFatalErr(ctxt, XML_ERR_LT_IN_ATTRIBUTE, NULL);
3808 } else if (RAW != limit) { 3808 } else if (RAW != limit) {
3809 if ((c != 0) && (!IS_CHAR(c))) { 3809 if ((c != 0) && (!IS_CHAR(c))) {
3810 xmlFatalErrMsg(ctxt, XML_ERR_INVALID_CHAR, 3810 xmlFatalErrMsg(ctxt, XML_ERR_INVALID_CHAR,
3811 "invalid character in attribute value\n"); 3811 "invalid character in attribute value\n");
3812 } else { 3812 } else {
3813 xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED, 3813 xmlFatalErrMsg(ctxt, XML_ERR_ATTRIBUTE_NOT_FINISHED,
(...skipping 11044 matching lines...) Expand 10 before | Expand all | Expand 10 after
14858 if (stream == NULL) { 14858 if (stream == NULL) {
14859 xmlFreeParserInputBuffer(input); 14859 xmlFreeParserInputBuffer(input);
14860 return (NULL); 14860 return (NULL);
14861 } 14861 }
14862 inputPush(ctxt, stream); 14862 inputPush(ctxt, stream);
14863 return (xmlDoRead(ctxt, URL, encoding, options, 1)); 14863 return (xmlDoRead(ctxt, URL, encoding, options, 1));
14864 } 14864 }
14865 14865
14866 #define bottom_parser 14866 #define bottom_parser
14867 #include "elfgcchack.h" 14867 #include "elfgcchack.h"
OLDNEW
« no previous file with comments | « third_party/libxml/README.chromium ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698