Index: third_party/libxml/src/parser.c |
diff --git a/third_party/libxml/src/parser.c b/third_party/libxml/src/parser.c |
index e3136123dca65738b9823706c4caa3fec04f3c4a..33786f08354ddcb1c4bcdaeb9b57d313cfaeff57 100644 |
--- a/third_party/libxml/src/parser.c |
+++ b/third_party/libxml/src/parser.c |
@@ -3426,8 +3426,15 @@ xmlParseNameComplex(xmlParserCtxtPtr ctxt) { |
xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "Name"); |
return(NULL); |
} |
- if ((*ctxt->input->cur == '\n') && (ctxt->input->cur[-1] == '\r')) |
+ if ((*ctxt->input->cur == '\n') && (ctxt->input->cur[-1] == '\r')) { |
+ if (ctxt->input->base > ctxt->input->cur - (len + 1)) { |
+ return(NULL); |
+ } |
return(xmlDictLookup(ctxt->dict, ctxt->input->cur - (len + 1), len)); |
+ } |
+ if (ctxt->input->base > ctxt->input->cur - len) { |
+ return(NULL); |
+ } |
return(xmlDictLookup(ctxt->dict, ctxt->input->cur - len, len)); |
} |