commit c05e032be5350e70e721727a96d5d4309f74af01
author Paul Duffin <paulduffin@google.com> Wed May 04 10:42:31 2016 +0100
committer Paul Duffin <paulduffin@google.com> Thu May 19 12:45:05 2016 +0000
tree 18f3a6e8303cc5c34aba6f1f74348844d7253fe2
parent 0af0cb3bc7519e567bd9daff3dcd315ab0134a99

Upgrade to expat 2.1.1

Modified the import_expat.sh script as the archive is now
compressed using bzip2 instead of gzip and uses configure.ac
instead of configure.in.

Modified README.android to make the example command up to date
with respect to the new archive format and also to ensure that
it builds dependencies.

All the remaining changes are straight from upstream.

Bug: 27818751

(cherry picked from commit cee23496d017f13eccc125e2ab7044de53dec8da)

Change-Id: Ic75a6c455dbcc34aaa7c30c109dc1565c5c52b04

lib/xmlparse.c

diff --git a/lib/xmlparse.c b/lib/xmlparse.c
index f35aa36..e308c79 100644
--- a/lib/xmlparse.c
+++ b/lib/xmlparse.c
@@ -1550,7 +1550,7 @@
   else if (bufferPtr == bufferEnd) {
     const char *end;
     int nLeftOver;
-    enum XML_Error result;
+    enum XML_Status result;
     parseEndByteIndex += len;
     positionPtr = s;
     ps_finalBuffer = (XML_Bool)isFinal;
@@ -1678,6 +1678,10 @@
 void * XMLCALL
 XML_GetBuffer(XML_Parser parser, int len)
 {
+  if (len < 0) {
+    errorCode = XML_ERROR_NO_MEMORY;
+    return NULL;
+  }
   switch (ps_parsing) {
   case XML_SUSPENDED:
     errorCode = XML_ERROR_SUSPENDED;
@@ -1689,8 +1693,11 @@
   }
 
   if (len > bufferLim - bufferEnd) {
-    /* FIXME avoid integer overflow */
     int neededSize = len + (int)(bufferEnd - bufferPtr);
+    if (neededSize < 0) {
+      errorCode = XML_ERROR_NO_MEMORY;
+      return NULL;
+    }
 #ifdef XML_CONTEXT_BYTES
     int keep = (int)(bufferPtr - buffer);
 
@@ -1719,7 +1726,11 @@
         bufferSize = INIT_BUFFER_SIZE;
       do {
         bufferSize *= 2;
-      } while (bufferSize < neededSize);
+      } while (bufferSize < neededSize && bufferSize > 0);
+      if (bufferSize <= 0) {
+        errorCode = XML_ERROR_NO_MEMORY;
+        return NULL;
+      }
       newBuf = (char *)MALLOC(bufferSize);
       if (newBuf == 0) {
         errorCode = XML_ERROR_NO_MEMORY;
@@ -2911,6 +2922,8 @@
         unsigned long uriHash = hash_secret_salt;
         ((XML_Char *)s)[-1] = 0;  /* clear flag */
         id = (ATTRIBUTE_ID *)lookup(parser, &dtd->attributeIds, s, 0);
+        if (!id || !id->prefix)
+          return XML_ERROR_NO_MEMORY;
         b = id->prefix->binding;
         if (!b)
           return XML_ERROR_UNBOUND_PREFIX;
@@ -5475,6 +5488,8 @@
             return NULL;
           id->prefix = (PREFIX *)lookup(parser, &dtd->prefixes, poolStart(&dtd->pool),
                                         sizeof(PREFIX));
+          if (!id->prefix)
+            return NULL;
           if (id->prefix->name == poolStart(&dtd->pool))
             poolFinish(&dtd->pool);
           else