diff options
-rw-r--r-- | parser.c | 9 |
1 files changed, 8 insertions, 1 deletions
@@ -3398,8 +3398,15 @@ xmlParseNameComplex(xmlParserCtxtPtr ctxt) { xmlFatalErr(ctxt, XML_ERR_NAME_TOO_LONG, "Name"); return(NULL); } - if ((*ctxt->input->cur == '\n') && (ctxt->input->cur[-1] == '\r')) + if (ctxt->input->cur > ctxt->input->base && (*ctxt->input->cur == '\n') && (ctxt->input->cur[-1] == '\r')) { + if (ctxt->input->base > ctxt->input->cur - (len + 1)) { + return(NULL); + } return(xmlDictLookup(ctxt->dict, ctxt->input->cur - (len + 1), len)); + } + if (ctxt->input->base > ctxt->input->cur - len) { + return(NULL); + } return(xmlDictLookup(ctxt->dict, ctxt->input->cur - len, len)); } |