tree 28deae11a8a5866c92c5a36ac79fe239c4153e49
parent c709f3f2676c1ea2499ad942f1e780a5325152c2
author Nick Wellnhofer <wellnhofer@aevum.de> 1505085256 +0200
committer Nick Wellnhofer <wellnhofer@aevum.de> 1505316064 +0200

Handle more invalid entity values in recovery mode

In attribute content, don't emit entity references if there are
problems with the entity value. Otherwise some illegal entity values
like

    <!ENTITY a '&#38;#x123456789;'>

would later cause problems like integer overflow.

Make xmlStringLenDecodeEntities return NULL on more error conditions
including invalid char refs and errors from recursive calls. Remove
some fragile error checks based on lastError that shouldn't be
needed now. Clear the entity content in xmlParseAttValueComplex if
an error was found.

Found by OSS-Fuzz. Should fix bug 783052.

Also see https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=3343