commit 9ff1d645bf56e49fb38dfef09d098882c38b2d80
author Sebastian Pipping <sebastian@pipping.org> Sun May 01 23:55:02 2016 +0200
committer Sebastian Pipping <sebastian@pipping.org> Mon May 02 01:00:32 2016 +0200
tree 752c4f2608614c7ece722e314f72447b8bd36a34
parent a9b80b4ae4a92acc123d22f39e4697bd4871cff3

Do not grow pool to out-of-memory for incomplete input

expat/lib/xmlparse.c

diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
index e810e3e..c1fe494 100644
--- a/expat/lib/xmlparse.c
+++ b/expat/lib/xmlparse.c
@@ -6196,15 +6196,12 @@
 poolAppend(STRING_POOL *pool, const ENCODING *enc,
            const char *ptr, const char *end)
 {
-  ICHAR* poolPtrPrev = NULL;
   if (!pool->ptr && !poolGrow(pool))
     return NULL;
   for (;;) {
-    XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end);
-    /* complete or zero progress? */
-    if (ptr == end || pool->ptr == poolPtrPrev)
+    const enum XML_Convert_Result convert_res = XmlConvert(enc, &ptr, end, (ICHAR **)&(pool->ptr), (ICHAR *)pool->end);
+    if ((convert_res == XML_CONVERT_COMPLETED) || (convert_res == XML_CONVERT_INPUT_INCOMPLETE))
       break;
-    poolPtrPrev = pool->ptr;
     if (!poolGrow(pool))
       return NULL;
   }