| Index: parser.c | |
| =================================================================== | |
| --- parser.c (revision 3773) | |
| +++ parser.c (working copy) | |
| @@ -2505,6 +2505,11 @@ xmlStringLenDecodeEntities(xmlParserCtxt | |
| c = CUR_SCHAR(str, l); | |
| else | |
| c = 0; | |
| + if ((nbchars > 500000) && | |
| + (ctxt->instate == XML_PARSER_ATTRIBUTE_VALUE)) { | |
| + xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL); | |
| + goto int_error; | |
| + } | |
| } | |
| buffer[nbchars++] = 0; | |
| return(buffer); |