summaryrefslogtreecommitdiff
path: root/extra/libxml2/CVE-2011-0216.patch
blob: dfc99d4dee476b72892f48e93809b2ec5fd16979 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
commit 69f04562f75212bfcabecd190ea8b06ace28ece2
Author: Daniel Veillard <veillard@redhat.com>
Date:   Fri Aug 19 11:05:04 2011 +0800

    Fix an off by one error in encoding
    
    this off by one error doesn't seems to reproduce on linux
    but the error is real.

diff --git a/encoding.c b/encoding.c
index d1140bf..fb0c38a 100644
--- a/encoding.c
+++ b/encoding.c
@@ -1928,7 +1928,7 @@ xmlCharEncFirstLineInt(xmlCharEncodingHandler *handler, xmlBufferPtr out,
     if (in == NULL) return(-1);
 
     /* calculate space available */
-    written = out->size - out->use;
+    written = out->size - out->use - 1; /* count '\0' */
     toconv = in->use;
     /*
      * echo '<?xml version="1.0" encoding="UCS4"?>' | wc -c => 38
@@ -2059,7 +2059,7 @@ xmlCharEncInFunc(xmlCharEncodingHandler * handler, xmlBufferPtr out,
     toconv = in->use;
     if (toconv == 0)
         return (0);
-    written = out->size - out->use;
+    written = out->size - out->use -1; /* count '\0' */
     if (toconv * 2 >= written) {
         xmlBufferGrow(out, out->size + toconv * 2);
         written = out->size - out->use - 1;