Fix bug reported by Rolf Ade:

CR at end of buffer in epilog causes memory access violation.

diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
index 2b4251d3b590a0a98993dfba504ea4038295d25d..35b5597e20ef88b79a539b014434b74a80d90615 100644 (file)
--- a/expat/lib/xmlparse.c
+++ b/expat/lib/xmlparse.c
@@ -4024,13 +4024,15 @@ epilogProcessor(XML_Parser parser,
     switch (tok) {
     case -XML_TOK_PROLOG_S:
       if (defaultHandler) {
-        eventEndPtr = end;
-        reportDefault(parser, encoding, s, end);
+        eventEndPtr = next;
+        reportDefault(parser, encoding, s, next);
       }
-      /* fall through */
+      if (nextPtr)
+        *nextPtr = next;
+      return XML_ERROR_NONE;
     case XML_TOK_NONE:
       if (nextPtr)
-        *nextPtr = end;
+        *nextPtr = s;
       return XML_ERROR_NONE;
     case XML_TOK_PROLOG_S:
       if (defaultHandler)

diff --git a/expat/lib/xmltok_impl.c b/expat/lib/xmltok_impl.c
index 1cc08f5583d15bdc34b5bb972a3580aead1959e4..30d32903e66b14687554228d74b5c3679dbc4c5a 100644 (file)
--- a/expat/lib/xmltok_impl.c
+++ b/expat/lib/xmltok_impl.c
@@ -1009,8 +1009,10 @@ PREFIX(prologTok)(const ENCODING *enc, const char *ptr, const char *end,
       return XML_TOK_INVALID;
     }
   case BT_CR:
-    if (ptr + MINBPC(enc) == end)
+    if (ptr + MINBPC(enc) == end) {
+      *nextTokPtr = end;
       return -XML_TOK_PROLOG_S;
+    }
     /* fall through */
   case BT_S: case BT_LF:
     for (;;) {