Apply a patch to prevent an integer overflow in expat.

Apply a patch to prevent an integer overflow in expat.

See https://www.mozilla.org/en-US/security/advisories/mfsa2015-54/ for Mozilla's advisory. Patch taken from https://hg.mozilla.org/releases/mozilla-esr31/rev/2f3e78643f5c

BUG=492052
Review URL: https://codereview.chromium.org/1151263010

Cr-Commit-Position: refs/heads/master@{#332964}
(cherry picked from commit 84ee0ec84f9de080e7d0e84dae6399d12c519d72)

Committed: https://chromium.googlesource.com/chromium/src/+/33f223ef93963e0efd0360445b28ce630f59bdc5

[Martin Barbella, 2015-07-10 16:54:21]

Committed patchset #1 (id:1) manually as
33f223ef93963e0efd0360445b28ce630f59bdc5.

[VZ, 2015-07-26 22:35:06]

https://codereview.chromium.org/1224303003/diff/1/third_party/expat/files/lib...
File third_party/expat/files/lib/xmlparse.c (right):

https://codereview.chromium.org/1224303003/diff/1/third_party/expat/files/lib...
third_party/expat/files/lib/xmlparse.c:1733: /* BEGIN MOZILLA CHANGE (prevent
infinite loop on overflow) */
This change doesn't seem to be ideal as it will result in returning an
out-of-memory error for neededSize just slightly larger than INT_MAX/2 which is
not that much under 32 bit architectures.

Wouldn't it be better to just set bufferSize to neededSize if it's big enough
(e.g. >= INT_MAX/2)?

[wrowe, 2015-08-06 18:45:50]

wrowe@pivotal.io changed reviewers:
+ wrowe@pivotal.io

[wrowe, 2015-08-06 18:45:51]

Simple suggestion for C89 correctness.

https://codereview.chromium.org/1224303003/diff/1/third_party/expat/files/lib...
File third_party/expat/files/lib/xmlparse.c (right):

https://codereview.chromium.org/1224303003/diff/1/third_party/expat/files/lib...
third_party/expat/files/lib/xmlparse.c:1698: int neededSize = len +
(int)(bufferEnd - bufferPtr);
Moving the patch below up one line (prior to int neededSize) will restore this
file as C89 compatible, with no side effect.

[daniel.gutson, 2015-09-01 13:17:03]

daniel.gutson@tallertechnologies.com changed reviewers:
+ daniel.gutson@tallertechnologies.com

[daniel.gutson, 2015-09-01 13:17:04]

I recommend using size_t rather than signed integers.

https://codereview.chromium.org/1224303003/diff/1/third_party/expat/files/lib...
File third_party/expat/files/lib/xmlparse.c (right):

https://codereview.chromium.org/1224303003/diff/1/third_party/expat/files/lib...
third_party/expat/files/lib/xmlparse.c:1698: int neededSize = len +
(int)(bufferEnd - bufferPtr);
May I ask why are you using signed types? A size should always be positive;
moreover, the type should be size_t