Blame test/recurse/lol4.patch
|
Packit |
423ecb |
Index: parser.c
|
|
Packit |
423ecb |
===================================================================
|
|
Packit |
423ecb |
--- parser.c (revision 3773)
|
|
Packit |
423ecb |
+++ parser.c (working copy)
|
|
Packit |
423ecb |
@@ -2505,6 +2505,11 @@ xmlStringLenDecodeEntities(xmlParserCtxt
|
|
Packit |
423ecb |
c = CUR_SCHAR(str, l);
|
|
Packit |
423ecb |
else
|
|
Packit |
423ecb |
c = 0;
|
|
Packit |
423ecb |
+ if ((nbchars > 500000) &&
|
|
Packit |
423ecb |
+ (ctxt->instate == XML_PARSER_ATTRIBUTE_VALUE)) {
|
|
Packit |
423ecb |
+ xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL);
|
|
Packit |
423ecb |
+ goto int_error;
|
|
Packit |
423ecb |
+ }
|
|
Packit |
423ecb |
}
|
|
Packit |
423ecb |
buffer[nbchars++] = 0;
|
|
Packit |
423ecb |
return(buffer);
|