Getting colder with our second freeze... it's 3.31.91 release day and string freeze, upload a tarball and lock those strings 🏂

Commit d8e1faea authored by Jüri Aedla's avatar Jüri Aedla Committed by Daniel Veillard

Fix an off by one pointer access

getting out of the range of memory allocated for xpointer decoding
parent fc74a6f5
......@@ -1007,21 +1007,14 @@ xmlXPtrEvalXPtrPart(xmlXPathParserContextPtr ctxt, xmlChar *name) {
NEXT;
break;
}
*cur++ = CUR;
} else if (CUR == '(') {
level++;
*cur++ = CUR;
} else if (CUR == '^') {
NEXT;
if ((CUR == ')') || (CUR == '(') || (CUR == '^')) {
*cur++ = CUR;
} else {
*cur++ = '^';
*cur++ = CUR;
}
} else {
*cur++ = CUR;
if ((NXT(1) == ')') || (NXT(1) == '(') || (NXT(1) == '^')) {
NEXT;
}
}
*cur++ = CUR;
NEXT;
}
*cur = 0;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment