42 lines
1010 B
Diff
42 lines
1010 B
Diff
From a6df42e649acacb55be832222d1f3f50c66720ff Mon Sep 17 00:00:00 2001
|
|
From: David Kilzer <ddkilzer@apple.com>
|
|
Date: Sat, 28 May 2022 08:08:29 -0700
|
|
Subject: [PATCH 296/300] Fix integer overflow in xmlBufferDump()
|
|
|
|
* tree.c:
|
|
(xmlBufferDump):
|
|
- Cap the return value to INT_MAX.
|
|
|
|
Reference:https://github.com/GNOME/libxml2/commit/a6df42e649acacb55be832222d1f3f50c66720ff
|
|
Conflict:NA
|
|
|
|
---
|
|
tree.c | 4 ++--
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/tree.c b/tree.c
|
|
index 0cf2483..3dff195 100644
|
|
--- a/tree.c
|
|
+++ b/tree.c
|
|
@@ -7380,7 +7380,7 @@ xmlBufferGrow(xmlBufferPtr buf, unsigned int len) {
|
|
*/
|
|
int
|
|
xmlBufferDump(FILE *file, xmlBufferPtr buf) {
|
|
- int ret;
|
|
+ size_t ret;
|
|
|
|
if (buf == NULL) {
|
|
#ifdef DEBUG_BUFFER
|
|
@@ -7399,7 +7399,7 @@ xmlBufferDump(FILE *file, xmlBufferPtr buf) {
|
|
if (file == NULL)
|
|
file = stdout;
|
|
ret = fwrite(buf->content, sizeof(xmlChar), buf->use, file);
|
|
- return(ret);
|
|
+ return(ret > INT_MAX ? INT_MAX : (int)ret);
|
|
}
|
|
|
|
/**
|
|
--
|
|
2.27.0
|
|
|