Amebis/wxWidgets
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Do not grow pool to out-of-memory for incomplete input

Browse Source
This commit is contained in:
Sebastian Pipping
2016-05-01 23:55:02 +02:00
committed by Vadim Zeitlin
parent 63688b5e58
commit f88eff9cdb
1 changed files with 2 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/expat/lib/xmlparse.c
View File

@@ -6174,15 +6174,12 @@ static XML_Char *
poolAppend(STRING_POOL *pool, const ENCODING *enc,
const char *ptr, const char *end)
{
ICHAR* poolPtrPrev = NULL;
if (!pool->ptr && !poolGrow(pool))
return NULL;
for (;;) {
XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end);
/* complete or zero progress? */
if (ptr == end || pool->ptr == poolPtrPrev)
const enum XML_Convert_Result convert_res = XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end);
if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
break;
poolPtrPrev = pool->ptr;
if (!poolGrow(pool))
return NULL;
}