commit e57436de7f4609974b1482adedf3fe328b2e92b5
Author: Hugh Davenport <hugh@allthethings.co.nz>
Date:   Sat Oct 10 23:15:27 2015 -0400

    Check there is enough data when parsing SAX characters
    
    For https://bugzilla.gnome.org/show_bug.cgi?id=756372
    
    If an input file has a tag that is is unknown, then the SAX parser will
    attempt to read beyond this input, potentially causing security issues.
    This patch adds a check into htmlParseTryOrFinish that checks whether
    there is enough data given the length to proceed.

diff --git a/HTMLparser.c b/HTMLparser.c
index 19c10c3..0cc8225 100644
--- a/HTMLparser.c
+++ b/HTMLparser.c
@@ -5728,17 +5728,17 @@ htmlParseTryOrFinish(htmlParserCtxtPtr ctxt, int terminate) {
 				if (ctxt->keepBlanks) {
 				    if (ctxt->sax->characters != NULL)
 					ctxt->sax->characters(
-						ctxt->userData, &cur, 1);
+						ctxt->userData, &in->cur[0], 1);
 				} else {
 				    if (ctxt->sax->ignorableWhitespace != NULL)
 					ctxt->sax->ignorableWhitespace(
-						ctxt->userData, &cur, 1);
+						ctxt->userData, &in->cur[0], 1);
 				}
 			    } else {
 				htmlCheckParagraph(ctxt);
 				if (ctxt->sax->characters != NULL)
 				    ctxt->sax->characters(
-					    ctxt->userData, &cur, 1);
+					    ctxt->userData, &in->cur[0], 1);
 			    }
 			}
 			ctxt->token = 0;
