- Expat: Fix DoS via XML document with malformed UTF-8 sequences
(CVE_2009_3560).
diff --git a/Misc/NEWS b/Misc/NEWS
index 7501e87..fa5df7d 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -66,6 +66,12 @@
Extension extra options may change the output without changing the .c
file). Initial patch by Collin Winter.
+Extension Modules
+-----------------
+
+- Expat: Fix DoS via XML document with malformed UTF-8 sequences
+ (CVE_2009_3560).
+
Build
-----
diff --git a/Modules/expat/xmlparse.c b/Modules/expat/xmlparse.c
index e04426d..105958b 100644
--- a/Modules/expat/xmlparse.c
+++ b/Modules/expat/xmlparse.c
@@ -3682,6 +3682,9 @@
return XML_ERROR_UNCLOSED_TOKEN;
case XML_TOK_PARTIAL_CHAR:
return XML_ERROR_PARTIAL_CHAR;
+ case -XML_TOK_PROLOG_S:
+ tok = -tok;
+ break;
case XML_TOK_NONE:
#ifdef XML_DTD
/* for internal PE NOT referenced between declarations */