Index: parser.c
¶ ↑
— parser.c (revision 3773) +++ parser.c (working copy) @@ -2505,6 +2505,11 @@ xmlStringLenDecodeEntities(xmlParserCtxt
c = CUR_SCHAR(str, l); else c = 0;
+ if ((nbchars > 500000) && + (ctxt->instate == XML_PARSER_ATTRIBUTE_VALUE)) { + xmlFatalErr(ctxt, XML_ERR_ENTITY_LOOP, NULL); + goto int_error; + }
} buffer[nbchars++] = 0; return(buffer);