Attachment #434506 for bug #583268




  }

  if (len > bufferLim - bufferEnd) {
    /* Do not invoke signed arithmetic overflow: */
    int neededSize = (int) ((unsigned)len + (unsigned)(bufferEnd - bufferPtr));
    if (neededSize < 0) {
      errorCode = XML_ERROR_NO_MEMORY;
      return NULL;

      if (bufferSize == 0)
        bufferSize = INIT_BUFFER_SIZE;
      do {
        /* Do not invoke signed arithmetic overflow: */
        bufferSize = (int) (2U * (unsigned) bufferSize);
      } while (bufferSize < neededSize && bufferSize > 0);
      if (bufferSize <= 0) {
        errorCode = XML_ERROR_NO_MEMORY;
- 

Return to bug 583268

Lines 1693-1699 XML_GetBuffer(XML_Parser parser, int len) Link Here

(-)a/expat/lib/xmlparse.c (-3 / +4 lines)
1693	}	1693	}
1694		1694
1695	if (len > bufferLim - bufferEnd) {	1695	if (len > bufferLim - bufferEnd) {
1696	int neededSize = len + (int)(bufferEnd - bufferPtr);	1696	/* Do not invoke signed arithmetic overflow: */
		1697	int neededSize = (int) ((unsigned)len + (unsigned)(bufferEnd - bufferPtr));
1697	if (neededSize < 0) {	1698	if (neededSize < 0) {
1698	errorCode = XML_ERROR_NO_MEMORY;	1699	errorCode = XML_ERROR_NO_MEMORY;
1699	return NULL;	1700	return NULL;
Lines 1725-1731 XML_GetBuffer(XML_Parser parser, int len) Link Here
1725	if (bufferSize == 0)	1726	if (bufferSize == 0)
1726	bufferSize = INIT_BUFFER_SIZE;	1727	bufferSize = INIT_BUFFER_SIZE;
1727	do {	1728	do {
1728	bufferSize *= 2;	1729	/* Do not invoke signed arithmetic overflow: */
		1730	bufferSize = (int) (2U * (unsigned) bufferSize);
1729	} while (bufferSize < neededSize && bufferSize > 0);	1731	} while (bufferSize < neededSize && bufferSize > 0);
1730	if (bufferSize <= 0) {	1732	if (bufferSize <= 0) {
1731	errorCode = XML_ERROR_NO_MEMORY;	1733	errorCode = XML_ERROR_NO_MEMORY;
1732	-