From c86f00c2af979997cd7668f1cd449b7d7ea63632 Mon Sep 17 00:00:00 2001
From: Remi Pointel <rpointel@cvs.openbsd.org>
Date: Fri, 13 May 2016 05:29:18 +0000
Subject: re-add the check we have in revision 1.12. ok jca@ (thanks).

---
 lib/libexpat/lib/xmlparse.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

(limited to 'lib')

diff --git a/lib/libexpat/lib/xmlparse.c b/lib/libexpat/lib/xmlparse.c
index 8bc1c2817d4..f32b66800cd 100644
--- a/lib/libexpat/lib/xmlparse.c
+++ b/lib/libexpat/lib/xmlparse.c
@@ -1683,7 +1683,7 @@ XML_ParseBuffer(XML_Parser parser, int len, int isFinal)
 void * XMLCALL
 XML_GetBuffer(XML_Parser parser, int len)
 {
-  if (len < 0) {
+  if (len < 0 || len > MAXLEN - (bufferEnd - bufferPtr)) {
     errorCode = XML_ERROR_NO_MEMORY;
     return NULL;
   }
@@ -1730,12 +1730,12 @@ XML_GetBuffer(XML_Parser parser, int len)
       if (bufferSize == 0)
         bufferSize = INIT_BUFFER_SIZE;
       do {
+        if (bufferSize > MAXLEN / 2) {
+          errorCode = XML_ERROR_NO_MEMORY;
+          return NULL;
+        }
         bufferSize *= 2;
-      } while (bufferSize < neededSize && bufferSize > 0);
-      if (bufferSize <= 0) {
-        errorCode = XML_ERROR_NO_MEMORY;
-        return NULL;
-      }
+      } while (bufferSize < neededSize);
       newBuf = (char *)MALLOC(bufferSize);
       if (newBuf == 0) {
         errorCode = XML_ERROR_NO_MEMORY;
-- 
cgit v1.2.3