diff options
Diffstat (limited to 'textproc/libxml2/files/patch-CVE-2008-4225')
| -rw-r--r-- | textproc/libxml2/files/patch-CVE-2008-4225 | 34 |
1 files changed, 17 insertions, 17 deletions
diff --git a/textproc/libxml2/files/patch-CVE-2008-4225 b/textproc/libxml2/files/patch-CVE-2008-4225 index 6d1155794f62..0666795c6abc 100644 --- a/textproc/libxml2/files/patch-CVE-2008-4225 +++ b/textproc/libxml2/files/patch-CVE-2008-4225 @@ -1,5 +1,5 @@ ---- tree.c.orig 2008-11-19 13:14:41.000000000 -0600 -+++ tree.c 2008-11-19 13:17:07.000000000 -0600 +--- tree.c.orig 2008-10-31 18:14:00.000000000 -0700 ++++ tree.c 2008-10-31 18:14:35.000000000 -0700 @@ -14,7 +14,7 @@ #include "libxml.h" @@ -9,18 +9,18 @@ #ifdef HAVE_CTYPE_H #include <ctype.h> #endif -@@ -6916,7 +6916,13 @@ - case XML_BUFFER_ALLOC_DOUBLEIT: - /*take care of empty case*/ - newSize = (buf->size ? buf->size*2 : size + 10); -- while (size > newSize) newSize *= 2; -+ while (size > newSize) { -+ if (newSize > UINT_MAX / 2) { -+ xmlTreeErrMemory("growing buffer"); -+ return 0; -+ } -+ newSize *= 2; -+ } - break; - case XML_BUFFER_ALLOC_EXACT: - newSize = size+10; +@@ -6996,7 +6996,13 @@ + case XML_BUFFER_ALLOC_DOUBLEIT: + /*take care of empty case*/ + newSize = (buf->size ? buf->size*2 : size + 10); +- while (size > newSize) newSize *= 2; ++ while (size > newSize) { ++ if (newSize > UINT_MAX / 2) { ++ xmlTreeErrMemory("growing buffer"); ++ return 0; ++ } ++ newSize *= 2; ++ } + break; + case XML_BUFFER_ALLOC_EXACT: + newSize = size+10; |