File libxml2-2.7.1-CVE-2008-4226.patch of Package libxml2
--- SAX2.c
+++ SAX2.c
@@ -11,6 +11,7 @@
#include "libxml.h"
#include <stdlib.h>
#include <string.h>
+#include <stdint.h>
#include <libxml/xmlmemory.h>
#include <libxml/tree.h>
#include <libxml/parser.h>
@@ -2455,9 +2456,14 @@
(xmlDictOwns(ctxt->dict, lastChild->content))) {
lastChild->content = xmlStrdup(lastChild->content);
}
+ if ((size_t)ctxt->nodelen > SIZE_MAX - (size_t)len ||
+ (size_t)ctxt->nodemem + (size_t)len > SIZE_MAX / 2) {
+ xmlSAX2ErrMemory(ctxt, "xmlSAX2Characters overflow prevented");
+ return;
+ }
if (ctxt->nodelen + len >= ctxt->nodemem) {
xmlChar *newbuf;
- int size;
+ size_t size;
size = ctxt->nodemem + len;
size *= 2;