Do not advance beyond the closing tag length in xmlParseEndTag2

third_party/libxml/src/parser.c

Index: third_party/libxml/src/parser.c
diff --git a/third_party/libxml/src/parser.c b/third_party/libxml/src/parser.c
index 0677030c2d9607eea36c424bf4f42f81d22245f2..71315cff4d62c637abe2052fc3c9ea998134e522 100644
--- a/third_party/libxml/src/parser.c
+++ b/third_party/libxml/src/parser.c
@@ -9825,8 +9825,9 @@ xmlParseEndTag2(xmlParserCtxtPtr ctxt, const xmlChar *prefix,
     }
     SKIP(2);
 
-    if ((tlen > 0) && (xmlStrncmp(ctxt->input->cur, ctxt->name, tlen) == 0)) {
-        if (ctxt->input->cur[tlen] == '>') {
+    size_t curLength = ctxt->input->end - ctxt->input->cur;
+    if ((tlen > 0) && (curLength >= (size_t)tlen) && (xmlStrncmp(ctxt->input->cur, ctxt->name, tlen) == 0)) {
+      if ((curLength >= (size_t)(tlen + 1)) && (ctxt->input->cur[tlen] == '>')) {
 	    ctxt->input->cur += tlen + 1;
 	    ctxt->input->col += tlen + 1;
 	    goto done;