tree 5ef6d4cd0cd726d33b5dd97370e420213e9bb86c
parent 433b318668bf2e0f3d56af6a87cb617107d2f290
author Nick Wellnhofer <wellnhofer@aevum.de> 1646766602 +0100
committer Nick Wellnhofer <wellnhofer@aevum.de> 1651493467 +0200

[CVE-2022-29824] Fix integer overflows in xmlBuf and xmlBuffer

In several places, the code handling string buffers didn't check for
integer overflow or used wrong types for buffer sizes. This could
result in out-of-bounds writes or other memory errors when working on
large, multi-gigabyte buffers.

Thanks to Felix Wilhelm for the report.