Check for overflow when merging text nodes.

third_party/libxslt/libxslt/transform.c

 /*
  * transform.c: Implementation of the XSL Transformation 1.0 engine
  *              transform part, i.e. applying a Stylesheet to a document
  *
  * References:
  *   http://www.w3.org/TR/1999/REC-xslt-19991116
  *
  *   Michael Kay "XSLT Programmer's Reference" pp 637-643
  *   Writing Multiple Output Files
  *
@@ skipping 802 matching lines @@
     /*
      * optimization
      */
     if ((len <= 0) || (string == NULL) || (target == NULL))
         return(target);
 
     if (ctxt->lasttext == target->content) {
 
         if (ctxt->lasttuse + len >= ctxt->lasttsize) {
             xmlChar *newbuf;
-            int size;
+            size_t size;
 
             size = ctxt->lasttsize + len + 100;
             size *= 2;
             newbuf = (xmlChar *) xmlRealloc(target->content,size);
-            if (newbuf == NULL) {
+            if (newbuf == NULL || size < ctxt->lasttsize) {

[scottmg, 2017/01/11 17:46:07]

This is intended to be an overflow check, or? (nominally we set size to
(lasttsize + len + 100) ^ 2).

lasttsize is unsigned int, but then we're calculating in a size_t... so I don't
understand how size could be < lasttsize.

(Apologies if I'm being dumb.)

[scottmg, 2017/01/11 18:02:23]

(Er, * 2 above obviously)

I guess on x86 it might make some sense if all the types are 32 bit.

I was thinking x64, so size_t of 8b vs ctxt->lasttsize and len of 4b.

                 xsltTransformError(ctxt, NULL, target,
                  "xsltCopyText: text allocation failed\n");
                 return(NULL);
             }
             ctxt->lasttsize = size;
             ctxt->lasttext = newbuf;
             target->content = newbuf;
         }
+        if (ctxt->lasttuse >= ctxt->lasttsize - len) {

[scottmg, 2017/01/11 17:46:07]

nit; This indent looks odd in Rietveld, but maybe it's fine with the right tab
settings.

+            xsltTransformError(ctxt, NULL, target,
+                               "xsltCopyText: text allocation failed\n");
+            return(NULL);
+        }
         memcpy(&(target->content[ctxt->lasttuse]), string, len);
         ctxt->lasttuse += len;
         target->content[ctxt->lasttuse] = 0;
     } else {
         xmlNodeAddContent(target, string);
         ctxt->lasttext = target->content;
         len = xmlStrlen(target->content);
         ctxt->lasttsize = len;
         ctxt->lasttuse = len;
     }
@@ skipping 5593 matching lines @@
                            XSLT_NAMESPACE,
                            (xsltTransformFunction) xsltDebug);
     xsltRegisterExtElement(ctxt, (const xmlChar *) "otherwise",
                            XSLT_NAMESPACE,
                            (xsltTransformFunction) xsltDebug);
     xsltRegisterExtElement(ctxt, (const xmlChar *) "fallback",
                            XSLT_NAMESPACE,
                            (xsltTransformFunction) xsltDebug);
 
 }