libxslt-1.1.26-pattern-out-of-bounds-read.patch 797 B

123456789101112131415161718192021222324252627
  1. From fe5a4fa33eb85bce3253ed3742b1ea6c4b59b41b Mon Sep 17 00:00:00 2001
  2. From: Abhishek Arya <inferno@chromium.org>
  3. Date: Sun, 22 Jan 2012 17:47:50 +0800
  4. Subject: [PATCH] Fix some case of pattern parsing errors
  5. We could accidentally hit an off by one string array access
  6. due to improper loop exit when parsing patterns
  7. ---
  8. libxslt/pattern.c | 2 ++
  9. 1 files changed, 2 insertions(+), 0 deletions(-)
  10. diff --git a/libxslt/pattern.c b/libxslt/pattern.c
  11. index 6161376..1155b54 100644
  12. --- a/libxslt/pattern.c
  13. +++ b/libxslt/pattern.c
  14. @@ -1867,6 +1867,8 @@ xsltCompilePatternInternal(const xmlChar *pattern, xmlDocPtr doc,
  15. while ((pattern[end] != 0) && (pattern[end] != '"'))
  16. end++;
  17. }
  18. + if (pattern[end] == 0)
  19. + break;
  20. end++;
  21. }
  22. if (current == end) {
  23. --
  24. 1.7.8.4