Fix integer overflow when counting written bytes
Check for integer overflow when updating the `written` member of
struct xmlOutputBuffer in xmlIO.c.
Closes #112. Resolves !54 and !55.
diff --git a/xmlIO.c b/xmlIO.c
index 2a1e2cb..752d5e0 100644
--- a/xmlIO.c
+++ b/xmlIO.c
@@ -3413,7 +3413,10 @@
out->error = XML_IO_WRITE;
return(ret);
}
- out->written += ret;
+ if (out->written > INT_MAX - ret)
+ out->written = INT_MAX;
+ else
+ out->written += ret;
}
written += nbchars;
} while (len > 0);
@@ -3609,7 +3612,10 @@
out->error = XML_IO_WRITE;
return(ret);
}
- out->written += ret;
+ if (out->written > INT_MAX - ret)
+ out->written = INT_MAX;
+ else
+ out->written += ret;
} else if (xmlBufAvail(out->buffer) < MINLEN) {
xmlBufGrow(out->buffer, MINLEN);
}
@@ -3703,7 +3709,10 @@
out->error = XML_IO_FLUSH;
return(ret);
}
- out->written += ret;
+ if (out->written > INT_MAX - ret)
+ out->written = INT_MAX;
+ else
+ out->written += ret;
#ifdef DEBUG_INPUT
xmlGenericError(xmlGenericErrorContext,
