Piotr Caban : msxml3: Fix illegal memory access.

[Alexandre Julliard]

Module: wine
Branch: master
Commit: a42a0917cd47113b810165a7f1a4551211a56025
URL:    http://source.winehq.org/git/wine.git/?a=commit;h=a42a0917cd47113b810165a7f1a4551211a56025

Author: Piotr Caban <piotr at codeweavers.com>
Date:   Sun Jun 27 15:21:28 2010 +0200

msxml3: Fix illegal memory access.

---

 dlls/msxml3/saxreader.c |    9 ++++++---
 1 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/dlls/msxml3/saxreader.c b/dlls/msxml3/saxreader.c
index a3de757..eca9f1d 100644
--- a/dlls/msxml3/saxreader.c
+++ b/dlls/msxml3/saxreader.c
@@ -1111,7 +1111,8 @@ static void libxmlEndElementNS(
 
     end = (xmlChar*)This->pParserCtxt->input->cur;
     if(*(end-1) != '>' || *(end-2) != '/')
-        while(*(end-2)!='<' && *(end-1)!='/') end--;
+        while(end-2>=This->pParserCtxt->input->base
+                && *(end-2)!='<' && *(end-1)!='/') end--;
 
     update_position(This, end);
 
@@ -1268,7 +1269,8 @@ static void libxmlComment(void *ctx, const xmlChar *value)
     HRESULT hr;
     xmlChar *beg = (xmlChar*)This->pParserCtxt->input->cur;
 
-    while(memcmp(beg-4, "<!--", sizeof(char[4]))) beg--;
+    while(beg-4>=This->pParserCtxt->input->base
+            && memcmp(beg-4, "<!--", sizeof(char[4]))) beg--;
     update_position(This, beg);
 
     if(!This->vbInterface && !This->saxreader->lexicalHandler) return;
@@ -1345,7 +1347,8 @@ static void libxmlCDataBlock(void *ctx, const xmlChar *value, int len)
     BSTR Chars;
     BOOL lastEvent = FALSE, change;
 
-    while(memcmp(beg-9, "<![CDATA[", sizeof(char[9]))) beg--;
+    while(beg-9>=This->pParserCtxt->input->base
+            && memcmp(beg-9, "<![CDATA[", sizeof(char[9]))) beg--;
     update_position(This, beg);
 
     if(This->vbInterface && This->saxreader->vblexicalHandler)