Expat: Applied patches to fix CVE-2009-3560 and CVE-2009-2625.

See e.g. here for more about these vulnerabilities: http://bugs.gentoo.org/show_bug.cgi?id=303727 http://bugs.gentoo.org/show_bug.cgi?id=280615
vslavik · Apr 11, 2010 · 22ed032 · 22ed032
1 parent 90917b0
commit 22ed032
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/3rdparty/expat/lib/xmlparse.c b/3rdparty/expat/lib/xmlparse.c
@@ -3703,6 +3703,9 @@ doProlog(XML_Parser parser,
         return XML_ERROR_UNCLOSED_TOKEN;
       case XML_TOK_PARTIAL_CHAR:
         return XML_ERROR_PARTIAL_CHAR;
+      case -XML_TOK_PROLOG_S:
+        tok = -tok;
+        break;
       case XML_TOK_NONE:
 #ifdef XML_DTD
         /* for internal PE NOT referenced between declarations */

diff --git a/3rdparty/expat/lib/xmltok_impl.c b/3rdparty/expat/lib/xmltok_impl.c
@@ -1744,7 +1744,7 @@ PREFIX(updatePosition)(const ENCODING *enc,
                        const char *end,
                        POSITION *pos)
 {
-  while (ptr != end) {
+  while (ptr < end) {
     switch (BYTE_TYPE(enc, ptr)) {
 #define LEAD_CASE(n) \
     case BT_LEAD ## n: \