From eb7d6c65617d1f04abf67113b4a5b195c08b630d Mon Sep 17 00:00:00 2001
From: disconnect3d <dominik.b.czarnota@gmail.com>
Date: Fri, 1 May 2020 13:22:55 +0200
Subject: [PATCH] Fix off by ones when parsing XML comments

This commit fixes off by ones when parsing XML comments.

The `strncmp` calls before this commit: strncmp(cursor, "<!--", 3) would also incorrectly match shorter strings such as "<!-". Depending on the use-cases this might or might not be vulnerabilities.

Depending on the use, this issue could be a security bug/risk for the
callers of this library, e.g. if two different XML parsing libraries
would be used for e.g. validating and then executing some rules. I would
even say this could cause bugs similar to
https://twitter.com/s1guza/status/1255641164885131268 to happen.

This issue was first reported to Google via
https://www.google.com/appserve/security-bugs/ but I was replied with
"We think the issue might not be severe enough for us to track it as a
security bug", so I am sending a fix here.
---
 .../extensions/libxml2_xml_parser/libxml2_xml_parser.cc         | 2 +-
 .../google_gadgets_for_linux/ggadget/win32/xml_parser.cc        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/client/third_party/google_gadgets_for_linux/extensions/libxml2_xml_parser/libxml2_xml_parser.cc b/client/third_party/google_gadgets_for_linux/extensions/libxml2_xml_parser/libxml2_xml_parser.cc
index e32e281..eb977a6 100644
--- a/client/third_party/google_gadgets_for_linux/extensions/libxml2_xml_parser/libxml2_xml_parser.cc
+++ b/client/third_party/google_gadgets_for_linux/extensions/libxml2_xml_parser/libxml2_xml_parser.cc
@@ -470,7 +470,7 @@ std::string GetHTMLCharset(const char* html_content) {
     if (!cursor)
       break;
 
-    if (strncmp(cursor, "<!--", 3) == 0) {
+    if (strncmp(cursor, "<!--", 4) == 0) {
       cursor = strstr(cursor, "-->");
       if (!cursor)
         break;
diff --git a/client/third_party/google_gadgets_for_linux/ggadget/win32/xml_parser.cc b/client/third_party/google_gadgets_for_linux/ggadget/win32/xml_parser.cc
index 675d625..3aef242 100644
--- a/client/third_party/google_gadgets_for_linux/ggadget/win32/xml_parser.cc
+++ b/client/third_party/google_gadgets_for_linux/ggadget/win32/xml_parser.cc
@@ -447,7 +447,7 @@ std::string GetHTMLCharset(const char* html_content) {
     if (!cursor)
       break;
 
-    if (strncmp(cursor, "<!--", 3) == 0) {
+    if (strncmp(cursor, "<!--", 4) == 0) {
       cursor = strstr(cursor, "-->");
       if (!cursor)
         break;