mirror of
https://github.com/libexpat/libexpat.git
synced 2025-04-13 08:02:56 +00:00
xmlparse.c: Fix XML_Size/XML_Index cast mixup
The "MAX = (type)-1" hack only works for unsigned types:
XML_Size is unsigned but XML_Index is not.
As the positive maximum of signed integers is about
half as big as that of their unsigned counterpart,
we divide by 2.
Example for 2 bit integers:
* signed: -2, -1, 0, 1 == 2^1-1
* unsigned: 0, 1, 2, 3 == 2^2-1
Fixing 4be2cb5afc
This commit is contained in:
parent
51308292cd
commit
7e5b71b748
1 changed files with 1 additions and 1 deletions
|
@ -1811,7 +1811,7 @@ XML_Parse(XML_Parser parser, const char *s, int len, int isFinal)
|
|||
int nLeftOver;
|
||||
enum XML_Status result;
|
||||
/* Detect overflow (a+b > MAX <==> b > MAX-a) */
|
||||
if (len > (XML_Index)-1 - parseEndByteIndex) {
|
||||
if (len > ((XML_Size)-1) / 2 - parseEndByteIndex) {
|
||||
errorCode = XML_ERROR_NO_MEMORY;
|
||||
eventPtr = eventEndPtr = NULL;
|
||||
processor = errorProcessor;
|
||||
|
|
Loading…
Add table
Reference in a new issue