Do not advance beyond the closing tag length in xmlParseEndTag2

third_party/libxml/src/parser.c

 /*
  * parser.c : an XML 1.0 parser, namespaces and validity support are mostly
  *            implemented on top of the SAX interfaces
  *
  * References:
  *   The XML specification:
  *     http://www.w3.org/TR/REC-xml
  *   Original 1.0 version:
  *     http://www.w3.org/TR/1998/REC-xml-19980210
  *   XML second edition working draft
@@ skipping 9807 matching lines @@
                 const xmlChar *URI, int line, int nsNr, int tlen) {
     const xmlChar *name;
 
     GROW;
     if ((RAW != '<') || (NXT(1) != '/')) {
         xmlFatalErr(ctxt, XML_ERR_LTSLASH_REQUIRED, NULL);
         return;
     }
     SKIP(2);
 
-    if ((tlen > 0) && (xmlStrncmp(ctxt->input->cur, ctxt->name, tlen) == 0)) {
-        if (ctxt->input->cur[tlen] == '>') {
+    size_t curLength = ctxt->input->end - ctxt->input->cur;
+    if ((tlen > 0) && (curLength >= (size_t)tlen) && (xmlStrncmp(ctxt->input->cur, ctxt->name, tlen) == 0)) {
+      if ((curLength >= (size_t)(tlen + 1)) && (ctxt->input->cur[tlen] == '>')) {
             ctxt->input->cur += tlen + 1;
             ctxt->input->col += tlen + 1;
             goto done;
         }
         ctxt->input->cur += tlen;
         ctxt->input->col += tlen;
         name = (xmlChar*)1;
     } else {
         if (prefix == NULL)
             name = xmlParseNameAndCompare(ctxt, ctxt->name);
@@ skipping 5927 matching lines @@
     if (stream == NULL) {
         xmlFreeParserInputBuffer(input);
         return (NULL);
     }
     inputPush(ctxt, stream);
     return (xmlDoRead(ctxt, URL, encoding, options, 1));
 }
 
 #define bottom_parser
 #include "elfgcchack.h"