You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@xerces.apache.org by sc...@apache.org on 2017/08/23 16:05:11 UTC
svn commit: r1805934 -
/xerces/c/trunk/src/xercesc/validators/common/DFAContentModel.cpp
Author: scantor
Date: Wed Aug 23 16:05:11 2017
New Revision: 1805934
URL: http://svn.apache.org/viewvc?rev=1805934&view=rev
Log:
XERCESC-2116 - Buffer overflow at XSD Validation
Modified:
xerces/c/trunk/src/xercesc/validators/common/DFAContentModel.cpp
Modified: xerces/c/trunk/src/xercesc/validators/common/DFAContentModel.cpp
URL: http://svn.apache.org/viewvc/xerces/c/trunk/src/xercesc/validators/common/DFAContentModel.cpp?rev=1805934&r1=1805933&r2=1805934&view=diff
==============================================================================
--- xerces/c/trunk/src/xercesc/validators/common/DFAContentModel.cpp (original)
+++ xerces/c/trunk/src/xercesc/validators/common/DFAContentModel.cpp Wed Aug 23 16:05:11 2017
@@ -1213,7 +1213,7 @@ void DFAContentModel::buildDFA(ContentSp
// if we're using counters.
//
if (elemOccurenceMap != 0) {
- fCountingStates = (Occurence**)fMemoryManager->allocate(fTransTableSize*sizeof(Occurence));
+ fCountingStates = (Occurence**)fMemoryManager->allocate(fTransTableSize*sizeof(Occurence*));
memset(fCountingStates, 0, fTransTableSize*sizeof(Occurence*));
for (unsigned int i = 0; i < fTransTableSize; ++i) {
unsigned int * transitions = fTransTable[i];
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@xerces.apache.org
For additional commands, e-mail: commits-help@xerces.apache.org