diff options
| author | Nick Wellnhofer <wellnhofer@aevum.de> | 2023-03-20 15:52:38 +0100 |
|---|---|---|
| committer | Nick Wellnhofer <wellnhofer@aevum.de> | 2023-03-20 15:53:42 +0100 |
| commit | 44ecefc8cc299a66ac21ffec141eb261e92638da (patch) | |
| tree | 4eefbe918f98565d7f872f4fe7952dc4f9352c0d | |
| parent | b1319c902f6e44d08f8cb33f1fc28847f2bc8aeb (diff) | |
| download | libxml2-44ecefc8cc299a66ac21ffec141eb261e92638da.tar.gz | |
malloc-fail: Fix buffer overread after htmlParseScript
Found by OSS-Fuzz, see #344.
| -rw-r--r-- | HTMLparser.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/HTMLparser.c b/HTMLparser.c index ca3ebc41..81bd11f9 100644 --- a/HTMLparser.c +++ b/HTMLparser.c @@ -3139,6 +3139,7 @@ htmlParseScript(htmlParserCtxtPtr ctxt) { htmlParseErrInt(ctxt, XML_ERR_INVALID_CHAR, "Invalid char in CDATA 0x%X\n", cur); } + NEXTL(l); if (nbchar >= HTML_PARSER_BIG_BUFFER_SIZE) { buf[nbchar] = 0; if (ctxt->sax->cdataBlock!= NULL) { @@ -3152,7 +3153,6 @@ htmlParseScript(htmlParserCtxtPtr ctxt) { nbchar = 0; SHRINK; } - NEXTL(l); cur = CUR_CHAR(l); } |