commit 1d4bc08a37e696de5cf414baa890d90c96764d64
author Sebastian Pipping <sebastian@pipping.org> Sat Jun 18 15:54:52 2016 +0200
committer Sebastian Pipping <sebastian@pipping.org> Sat Jun 18 16:33:43 2016 +0200
tree 70f2d90d17c90c65cca21ff5b15d016b6d936379
parent 5a5b157ba3ee4107d1411b3e2e0c597a60c7dbd8

Fix infinite loop

Regression from 30145890579e3e7fca548129260b2ac6a545d2ef

https://marcograss.github.io/security/android/chromium/2016/06/17/expat-xml-heap-overflow.html

expat/Changes

diff --git a/expat/Changes b/expat/Changes
index 292c633..512364d 100644
--- a/expat/Changes
+++ b/expat/Changes
@@ -40,6 +40,7 @@
             Gustavo Grieco
             Karl Waclawek
             László Böszörményi
+            Marco Grassi
             Pascal Cuoq
             Sergei Nikulov
             Thomas Beutlich

expat/lib/xmltok_impl.c

diff --git a/expat/lib/xmltok_impl.c b/expat/lib/xmltok_impl.c
index fd0ee22..5f779c0 100644
--- a/expat/lib/xmltok_impl.c
+++ b/expat/lib/xmltok_impl.c
@@ -1198,6 +1198,8 @@
   const char *start;
   if (ptr >= end)
     return XML_TOK_NONE;
+  else if (! HAS_CHAR(enc, ptr, end))
+    return XML_TOK_PARTIAL;
   start = ptr;
   while (HAS_CHAR(enc, ptr, end)) {
     switch (BYTE_TYPE(enc, ptr)) {
@@ -1256,6 +1258,8 @@
   const char *start;
   if (ptr >= end)
     return XML_TOK_NONE;
+  else if (! HAS_CHAR(enc, ptr, end))
+    return XML_TOK_PARTIAL;
   start = ptr;
   while (HAS_CHAR(enc, ptr, end)) {
     switch (BYTE_TYPE(enc, ptr)) {

htdocs/index.html

diff --git a/htdocs/index.html b/htdocs/index.html
index c76b514..2cbbe85 100644
--- a/htdocs/index.html
+++ b/htdocs/index.html
@@ -120,6 +120,7 @@
       <li>Gustavo Grieco</li>
       <li>Karl Waclawek</li>
       <li>László Böszörményi</li>
+      <li>Marco Grassi</li>
       <li>Pascal Cuoq</li>
       <li>Sergei Nikulov</li>
       <li>Thomas Beutlich</li>