From 0b89b79c50d9a0a22f23d1ba40a73f9f3cd54da2 Mon Sep 17 00:00:00 2001
From: crvi <crvisqr@gmail.com>
Date: Wed, 7 Apr 2021 04:00:30 +0530
Subject: core: fix garbage in CDATA values for shorter texts

This change properly null terminates the CDATA values. For shorter
CDATA values, this fix is mandatory to override the token buffer text
which contains the previous token value of '<![CDATA['. CDATA value is
overwritten on top of this CDATA marker causing garbage data.

For longer CDATA values, this wasn't an issue, as the token buffer (
64K ) is already filled with NULL chars, causing this issue to not
show up.

Closes: #30
---
 plparse/xmllexer.c | 1 +
 1 file changed, 1 insertion(+)

(limited to 'plparse')

diff --git a/plparse/xmllexer.c b/plparse/xmllexer.c
index 818e7f8..fc448ea 100644
--- a/plparse/xmllexer.c
+++ b/plparse/xmllexer.c
@@ -541,6 +541,7 @@ int lexer_get_token_d_r(struct lexer * lexer, char ** _tok, int * _tok_size, int
 	  if (strncmp(lexer->lexbuf + lexer->lexbuf_pos, "]]>", 3) == 0) {
 	    lexer->lexbuf_pos += 3;
 	    lexer->lex_mode = DATA;
+	    tok[tok_pos] = '\0';
 	    return T_CDATA_STOP;
 	  } else {
 	    tok[tok_pos] = c;
-- 
cgit v1.2.1