diff options
| author | Remi Pointel <rpointel@cvs.openbsd.org> | 2016-07-29 18:57:40 +0000 |
|---|---|---|
| committer | Remi Pointel <rpointel@cvs.openbsd.org> | 2016-07-29 18:57:40 +0000 |
| commit | 4d0cbf4a220cf8d4a55e29cdf395b78de055597d (patch) | |
| tree | e10626a8ea60a90f9731ae459de1428aeeb1e075 /lib/libexpat | |
| parent | 1b4fa8bf6a0a9024bd1c3c5270fa8d98e7bc6c48 (diff) | |
Fix regression introduced by patch to CVE-2016-0718: Tag names were cut off in some cases.
Diffstat (limited to 'lib/libexpat')
| -rw-r--r-- | lib/libexpat/lib/xmlparse.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/libexpat/lib/xmlparse.c b/lib/libexpat/lib/xmlparse.c index 3bb80eee27e..2569fef7900 100644 --- a/lib/libexpat/lib/xmlparse.c +++ b/lib/libexpat/lib/xmlparse.c @@ -2435,7 +2435,7 @@ doContent(XML_Parser parser, &fromPtr, rawNameEnd, (ICHAR **)&toPtr, (ICHAR *)tag->bufEnd - 1); convLen = (int)(toPtr - (XML_Char *)tag->buf); - if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE)) { + if ((fromPtr >= rawNameEnd) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE)) { tag->name.strLen = convLen; break; } |