Amebis/wxWidgets
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Do not grow pool to out-of-memory for incomplete input

Browse Source
This commit is contained in:
Sebastian Pipping
2016-05-01 23:55:02 +02:00
committed by Vadim Zeitlin
parent d8d581a382
commit 7f6194038a
1 changed files with 2 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/expat/lib/xmlparse.c
View File

@@ -6174,15 +6174,12 @@ static XML_Char *
poolAppend(STRING_POOL *pool, const ENCODING *enc, poolAppend(STRING_POOL *pool, const ENCODING *enc,
const char *ptr, const char *end) const char *ptr, const char *end)
{ {
ICHAR* poolPtrPrev = NULL;
if (!pool->ptr && !poolGrow(pool)) if (!pool->ptr && !poolGrow(pool))
return NULL; return NULL;
for (;;) { for (;;) {
XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end); const enum XML_Convert_Result convert_res = XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end);
/* complete or zero progress? */ if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
if (ptr == end || pool->ptr == poolPtrPrev)
break; break;
poolPtrPrev = pool->ptr;
if (!poolGrow(pool)) if (!poolGrow(pool))
return NULL; return NULL;
} }