Skip to content

HTTPS clone URL

Subversion checkout URL

You can clone with HTTPS or Subversion.

Download ZIP
Browse files

Fix an off by one pointer access

getting out of the range of memory allocated for xpointer decoding
  • Loading branch information...
commit d8e1faeaa99c7a7c07af01c1c72de352eb590a3e 1 parent fc74a6f
Jüri Aedla authored veillard committed
Showing with 4 additions and 11 deletions.
  1. +4 −11 xpointer.c
View
15 xpointer.c
@@ -1007,21 +1007,14 @@ xmlXPtrEvalXPtrPart(xmlXPathParserContextPtr ctxt, xmlChar *name) {
NEXT;
break;
}
- *cur++ = CUR;
} else if (CUR == '(') {
level++;
- *cur++ = CUR;
} else if (CUR == '^') {
- NEXT;
- if ((CUR == ')') || (CUR == '(') || (CUR == '^')) {
- *cur++ = CUR;
- } else {
- *cur++ = '^';
- *cur++ = CUR;
- }
- } else {
- *cur++ = CUR;
+ if ((NXT(1) == ')') || (NXT(1) == '(') || (NXT(1) == '^')) {
+ NEXT;
+ }
}
+ *cur++ = CUR;
NEXT;
}
*cur = 0;
Please sign in to comment.
Something went wrong with that request. Please try again.