From fb523d10cced8322d70b2b52f0e498382aef2c31 Mon Sep 17 00:00:00 2001
From: Karl Waclawek <kwaclaw@users.sourceforge.net>
Date: Fri, 30 Aug 2002 23:22:20 +0000
Subject: [PATCH] Fix bug reported by Rolf Ade: CR at end of buffer in epilog
 causes memory access violation.

---
 expat/lib/xmlparse.c    | 10 ++++++----
 expat/lib/xmltok_impl.c |  4 +++-
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
index 2b4251d3..35b5597e 100644
--- a/expat/lib/xmlparse.c
+++ b/expat/lib/xmlparse.c
@@ -4024,13 +4024,15 @@ epilogProcessor(XML_Parser parser,
     switch (tok) {
     case -XML_TOK_PROLOG_S:
       if (defaultHandler) {
-        eventEndPtr = end;
-        reportDefault(parser, encoding, s, end);
+        eventEndPtr = next;
+        reportDefault(parser, encoding, s, next);
       }
-      /* fall through */
+      if (nextPtr)
+        *nextPtr = next;
+      return XML_ERROR_NONE;
     case XML_TOK_NONE:
       if (nextPtr)
-        *nextPtr = end;
+        *nextPtr = s;
       return XML_ERROR_NONE;
     case XML_TOK_PROLOG_S:
       if (defaultHandler)
diff --git a/expat/lib/xmltok_impl.c b/expat/lib/xmltok_impl.c
index 1cc08f55..30d32903 100644
--- a/expat/lib/xmltok_impl.c
+++ b/expat/lib/xmltok_impl.c
@@ -1009,8 +1009,10 @@ PREFIX(prologTok)(const ENCODING *enc, const char *ptr, const char *end,
       return XML_TOK_INVALID;
     }
   case BT_CR:
-    if (ptr + MINBPC(enc) == end)
+    if (ptr + MINBPC(enc) == end) {
+      *nextTokPtr = end;
       return -XML_TOK_PROLOG_S;
+    }
     /* fall through */
   case BT_S: case BT_LF:
     for (;;) {