| Index: third_party/libxml/src/parser.c
|
| diff --git a/third_party/libxml/src/parser.c b/third_party/libxml/src/parser.c
|
| index e3136123dca65738b9823706c4caa3fec04f3c4a..33786f08354ddcb1c4bcdaeb9b57d313cfaeff57 100644
|
| --- a/third_party/libxml/src/parser.c
|
| +++ b/third_party/libxml/src/parser.c
|
| @@ -3426,8 +3426,15 @@ xmlParseNameComplex(xmlParserCtxtPtr ctxt) {
|
| xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "Name");
|
| return(NULL);
|
| }
|
| - if ((*ctxt->input->cur == '\n') && (ctxt->input->cur[-1] == '\r'))
|
| + if ((*ctxt->input->cur == '\n') && (ctxt->input->cur[-1] == '\r')) {
|
| + if (ctxt->input->base > ctxt->input->cur - (len + 1)) {
|
| + return(NULL);
|
| + }
|
| return(xmlDictLookup(ctxt->dict, ctxt->input->cur - (len + 1), len));
|
| + }
|
| + if (ctxt->input->base > ctxt->input->cur - len) {
|
| + return(NULL);
|
| + }
|
| return(xmlDictLookup(ctxt->dict, ctxt->input->cur - len, len));
|
| }
|
|
|
|
|