Do not advance beyond the closing tag length in xmlParseEndTag2

Do not advance beyond the closing tag length in xmlParseEndTag2

BUG=593690, 595262
TEST=libxml_xml_read_memory_fuzzer

Committed: https://crrev.com/27a27edb43e42023db7d154dcd9f66a500296cc1
Cr-Commit-Position: refs/heads/master@{#388137}

[dominicc (has gone to gerrit), 2016-04-08 07:01:42]

dominicc@chromium.org changed reviewers:
+ scottmg@chromium.org

[dominicc (has gone to gerrit), 2016-04-08 07:01:57]

PTAL

[scottmg, 2016-04-08 14:42:11]

lgtm

https://codereview.chromium.org/1873693002/diff/1/third_party/libxml/README.c...
File third_party/libxml/README.chromium (right):

https://codereview.chromium.org/1873693002/diff/1/third_party/libxml/README.c...
third_party/libxml/README.chromium:18: - Add patch from
https://bugs.chromium.org/p/chromium/issues/detail?id=595262#c13
I can't see this bug, but please upload it upstream too if it's not there yet.

[dominicc (has gone to gerrit), 2016-04-11 08:33:48]

The CQ bit was checked by dominicc@chromium.org

[commit-bot: I haz the power, 2016-04-11 08:34:04]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1873693002/1
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1873693002/1

[commit-bot: I haz the power, 2016-04-11 09:01:54]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-04-11 09:01:55]

Try jobs failed on following builders:
  mac_chromium_rel_ng on tryserver.chromium.mac (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.mac/builders/mac_chromium_rel_...)

[dominicc (has gone to gerrit), 2016-04-17 13:00:18]

Scott, could I get you to take another look at this? I adopted a patch attached
to an upstream bug; Mac builders were unhappy linking strnlen.

[dominicc (has gone to gerrit), 2016-04-18 00:43:16]

On 2016/04/17 at 13:00:18, dominicc wrote:
> Scott, could I get you to take another look at this? I adopted a patch
attached to an upstream bug; Mac builders were unhappy linking strnlen.

More context: The upstream bug was the one ddkilzer points to here:

https://bugs.chromium.org/p/chromium/issues/detail?id=595262#c15

[scottmg, 2016-04-18 16:33:41]

lgtm

[dominicc (has gone to gerrit), 2016-04-19 03:40:04]

The CQ bit was checked by dominicc@chromium.org

[commit-bot: I haz the power, 2016-04-19 03:40:21]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/1873693002/20001
View timeline at
 https://chromium-cq-status.appspot.com/patch-timeline/1873693002/20001

[commit-bot: I haz the power, 2016-04-19 04:46:51]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2016-04-19 04:48:09]

Description was changed from

==========
Do not advance beyond the closing tag length in xmlParseEndTag2

BUG=593690,595262
TEST=libxml_xml_read_memory_fuzzer
==========

to

==========
Do not advance beyond the closing tag length in xmlParseEndTag2

BUG=593690,595262
TEST=libxml_xml_read_memory_fuzzer

Committed: https://crrev.com/27a27edb43e42023db7d154dcd9f66a500296cc1
Cr-Commit-Position: refs/heads/master@{#388137}
==========

[commit-bot: I haz the power, 2016-04-19 04:48:10]

Patchset 2 (id:??) landed as
https://crrev.com/27a27edb43e42023db7d154dcd9f66a500296cc1
Cr-Commit-Position: refs/heads/master@{#388137}