commit 35bcb1d758ed70aa7b257c9c3b3ff55e54e3d0da
author Daniel Veillard <veillard@redhat.com> Fri Nov 20 15:04:09 2015 +0800
committer Daniel Veillard <veillard@redhat.com> Fri Nov 20 15:04:09 2015 +0800
tree 2b2cab2edfa88b6a2db8e2ba44aed391769b9d57
parent ce0b0d0d81fdbb5f722a890432b52d363e4de57b

Detect incoherency on GROW

the current pointer to the input has to be between the base and end
if not stop everything we have an internal state error.

parser.c

diff --git a/parser.c b/parser.c
index 1810f99..ab007aa 100644
--- a/parser.c
+++ b/parser.c
@@ -2075,9 +2075,16 @@
          ((ctxt->input->buf) && (ctxt->input->buf->readcallback != (xmlInputReadCallback) xmlNop)) &&
         ((ctxt->options & XML_PARSE_HUGE) == 0)) {
         xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR, "Huge input lookup");
-        ctxt->instate = XML_PARSER_EOF;
+        xmlHaltParser(ctxt);
+	return;
     }
     xmlParserInputGrow(ctxt->input, INPUT_CHUNK);
+    if ((ctxt->input->cur > ctxt->input->end) ||
+        (ctxt->input->cur < ctxt->input->base)) {
+        xmlHaltParser(ctxt);
+        xmlFatalErr(ctxt, XML_ERR_INTERNAL_ERROR, "cur index out of bound");
+	return;
+    }
     if ((ctxt->input->cur != NULL) && (*ctxt->input->cur == 0) &&
         (xmlParserInputGrow(ctxt->input, INPUT_CHUNK) <= 0))
 	    xmlPopInput(ctxt);