)]}'
{
  "commit": "776e1c312dc273a031ef0c3f4d67ba702c5308d3",
  "tree": "9b9b80bcdf198b4d500f594da6a017bfe5c12958",
  "parents": [
    "fe9f76ebb8127e77cbbf25d9235ceb523d3a4a92"
  ],
  "author": {
    "name": "David Kilzer",
    "email": "ddkilzer@apple.com",
    "time": "Fri May 13 14:43:33 2022 -0700"
  },
  "committer": {
    "name": "David Kilzer",
    "email": "ddkilzer@apple.com",
    "time": "Wed May 25 18:29:41 2022 -0700"
  },
  "message": "Fix more overflow checks, off-by-ones and missing NUL terminators in xmlBuf and xmlBuffer\n\nIn broad strokes, this does the following:\n- Do not include the NUL terminator byte for lengths returned\n  from functions.  This lets functions be more defensive.\n- Set error messages when returning early due to out-of-memory\n  or buffer-too-large errors.\n- Set NUL terminator consistently on buffer boundaries before\n  returning.\n- Add a few more integer overflow checks.\n\n* buf.c:\n(xmlBufGrowInternal):\n- Do not include NUL terminator byte when returning length.\n- Always set NUL terminator at the end of the new buffer length\n  before returning.\n- Call xmlBufMemoryError() when the buffer size would overflow.\n- Account for NUL terminator byte when using XML_MAX_TEXT_LENGTH.\n- Always set NUL terminator at the end of the current buffer\n  after resizing the buffer.\n(xmlBufAddLen):\n- Return an error if the buffer does not have free space for the\n  NUL terminator byte.\n(xmlBufAvail):\n- Do not include the NUL terminator byte in the length returned.\n  (See changes to encoding.c and xmlIO.c.)\n(xmlBufResize):\n- Move setting of NUL terminator to common code.  More than one\n  path through the function failed to set it.\n(xmlBufAdd):\n- Call xmlBufMemoryError() when the buffer size would overflow.\n\n* encoding.c:\n(xmlCharEncFirstLineInput):\n(xmlCharEncInput):\n(xmlCharEncOutput):\n- No longer need to subtract one from the return value of\n  xmlBufAvail() since the function does this now.\n\n* testchar.c:\n(testCharRanges):\n- Pass the string length without the NUL terminator.\n\n* tree.c:\n(xmlBufferGrow):\n- Do not include NUL terminator byte when returning length.\n- Always set NUL terminator at the end of the new buffer length\n  before returning.\n- Call xmlTreeErrMemory() when the buffer size would overflow.\n- Always set NUL terminator at the end of the current buffer\n  after resizing the buffer.\n(xmlBufferDump):\n- Change type of the return variable to match fwrite().\n- Clamp return value to INT_MAX to prevent overflow.\n(xmlBufferResize):\n- Update error message in xmlTreeErrMemory() to be consistent\n  with other similar messages.\n- Move setting of NUL terminator to common code.  More than one\n  path through the function failed to set it.\n(xmlBufferAdd):\n- Call xmlTreeErrMemory() when the buffer size would overflow.\n(xmlBufferAddHead):\n- Set NUL terminator before returning early when shifting\n  contents.\n- Add overflow checks similar to those in xmlBufferAdd().\n\n* xmlIO.c:\n(xmlOutputBufferWriteEscape):\n- No longer need to subtract one from the return value of\n  xmlBufAvail() since the function does this now.\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "0a798f5910da137a1b5e33bb7d272c765499420c",
      "old_mode": 33188,
      "old_path": "buf.c",
      "new_id": "a5df00bd60a5f5a2416934094d668e01d748c648",
      "new_mode": 33188,
      "new_path": "buf.c"
    },
    {
      "type": "modify",
      "old_id": "0a820498bd227554946426e8c3789634a4a98cb3",
      "old_mode": 33188,
      "old_path": "encoding.c",
      "new_id": "1b5ae9f35a9b3f2faaf76487096b2708b10b83e9",
      "new_mode": 33188,
      "new_path": "encoding.c"
    },
    {
      "type": "modify",
      "old_id": "bd1a8d6498f2fa85105f5453eedbf3775a8d751e",
      "old_mode": 33188,
      "old_path": "testchar.c",
      "new_id": "7132c921b14f109af3eee4abad59c209b2348763",
      "new_mode": 33188,
      "new_path": "testchar.c"
    },
    {
      "type": "modify",
      "old_id": "df17fa3398dccf2cfd57eec99468f7717157e165",
      "old_mode": 33188,
      "old_path": "tree.c",
      "new_id": "9ad7616fda67e95b576351d31267cd7b43209123",
      "new_mode": 33188,
      "new_path": "tree.c"
    },
    {
      "type": "modify",
      "old_id": "823a0dda564c3c37f339b72fc4844bc1e00ff23b",
      "old_mode": 33188,
      "old_path": "xmlIO.c",
      "new_id": "16c29f57a443800a978e3c5da85a325ef4a433f4",
      "new_mode": 33188,
      "new_path": "xmlIO.c"
    }
  ]
}