commit 034608d5e5625eb3d6dd6c38e70cc161ec88aa3a
Author: Hugh Davenport <hugh@allthethings.co.nz>
Date:   Sat Oct 10 23:15:27 2015 -0400

    Check there is enough data when parsing SAX characters
    
    For https://bugzilla.gnome.org/show_bug.cgi?id=756372
    
    If an input file has a tag that is is unknown, then the SAX parser will
    attempt to read beyond this input, potentially causing security issues.
    This patch adds a check into xmlSAX2Characters that checks whether
    there is enough data given the length to proceed.

diff --git a/SAX2.c b/SAX2.c
index ffef3e1..e711bbc 100644
--- a/SAX2.c
+++ b/SAX2.c
@@ -2523,6 +2523,13 @@ xmlSAX2Characters(void *ctx, const xmlChar *ch, int len)
     xmlGenericError(xmlGenericErrorContext,
 	    "SAX.xmlSAX2Characters(%.30s, %d)\n", ch, len);
 #endif
+    if (ch + len >= ctxt->input->end) {
+#ifdef DEBUG_SAX_TREE
+	xmlGenericError(xmlGenericErrorContext,
+		"add chars: ctxt->input->cur + len >= ctxt->input->end !\n");
+#endif
+        return;
+    }
     /*
      * Handle the data if any. If there is no child
      * add it as content, otherwise if the last child is text,
