diff options
| author |   rpointel <rpointel@openbsd.org> | 2016-07-29 18:57:39 +0000 |
|---|---|---|
| committer | rpointel <rpointel@openbsd.org> | 2016-07-29 18:57:39 +0000 |
| commit | d9d225e44d6462191a30350d423af47ac33ca59e (patch) | |
| tree | 5e338b160012525813592f71e9914129cba6f2b6 | |
| parent | all of the update functions take a size_t. correct type and casts. (diff) | |
| download | wireguard-openbsd-d9d225e44d6462191a30350d423af47ac33ca59e.tar.xz wireguard-openbsd-d9d225e44d6462191a30350d423af47ac33ca59e.zip | |
Fix regression introduced by patch to CVE-2016-0718: Tag names were cut off in some cases.
| -rw-r--r-- | lib/libexpat/lib/xmlparse.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/libexpat/lib/xmlparse.c b/lib/libexpat/lib/xmlparse.c index 3bb80eee27e..2569fef7900 100644 --- a/lib/libexpat/lib/xmlparse.c +++ b/lib/libexpat/lib/xmlparse.c @@ -2435,7 +2435,7 @@ doContent(XML_Parser parser, &fromPtr, rawNameEnd, (ICHAR **)&toPtr, (ICHAR *)tag->bufEnd - 1); convLen = (int)(toPtr - (XML_Char *)tag->buf); - if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE)) { + if ((fromPtr >= rawNameEnd) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE)) { tag->name.strLen = convLen; break; } |