Fix use-after-free in xmlParseContentInternal()

* parser.c:
(xmlParseCharData):
- Check if the parser has stopped before advancing
  `ctxt->input->cur`.  This only occurs if a custom SAX error
  handler calls xmlStopParser() on fatal errors.

Fixes #518.

1 files changed, 2 insertions, 1 deletions

diff --git a/parser.c b/parser.c
index 933dfb93..523e59de 100644
--- a/parser.c
+++ b/parser.c
@@ -4447,7 +4447,8 @@ get_more:
         if (*in == ']') {
             if ((in[1] == ']') && (in[2] == '>')) {
                 xmlFatalErr(ctxt, XML_ERR_MISPLACED_CDATA_END, NULL);
-                ctxt->input->cur = in + 1;
+                if (ctxt->instate != XML_PARSER_EOF)
+                    ctxt->input->cur = in + 1;
                 return;
             }
             in++;