commit 925bf2e9dd736a1ae6535aab8e41904747d28197
Author: Hugh Davenport <hugh@allthethings.co.nz>
Date:   Sat Oct 10 23:15:27 2015 -0400

    Check there is enough data when parsing SAX characters
    
    For https://bugzilla.gnome.org/show_bug.cgi?id=756372
    
    If an input file has a tag that is is unknown, then the SAX parser will
    attempt to read beyond this input, potentially causing security issues.
    This patch adds a check into htmlParseTryOrFinish that checks whether
    there is enough data given the length to proceed.

diff --git a/HTMLparser.c b/HTMLparser.c
index 19c10c3..5d1ed27 100644
--- a/HTMLparser.c
+++ b/HTMLparser.c
@@ -5723,7 +5723,8 @@ htmlParseTryOrFinish(htmlParserCtxtPtr ctxt, int terminate) {
 		if ((avail == 1) && (terminate)) {
 		    cur = in->cur[0];
 		    if ((cur != '<') && (cur != '&')) {
-			if (ctxt->sax != NULL) {
+			if (ctxt->sax != NULL &&
+                            &cur + 1 < in->end) {
 			    if (IS_BLANK_CH(cur)) {
 				if (ctxt->keepBlanks) {
 				    if (ctxt->sax->characters != NULL)
