fix possible mem corruption in filter_restricted()

[mlt] / src / modules / xml / consumer_xml.c

diff --git a/src/modules/xml/consumer_xml.c b/src/modules/xml/consumer_xml.c
index 3e1544b54e60a2ad2f0bcd414bbb879a234959f6..6d0ef145070d6bd4ccc848fde53a5e60c9aac293 100644 (file)
--- a/src/modules/xml/consumer_xml.c
+++ b/src/modules/xml/consumer_xml.c
@@ -72,7 +72,7 @@ static char* filter_restricted( const char *in )
        {
                wchar_t w;
                size_t c = mbrtowc( &w, in, n, &mbs );
-               if ( c <= 0 ) break;
+               if ( c <= 0 || c > n ) break;
                n -= c;
                in += c;
                if ( w == 0x9 || w == 0xA || w == 0xD ||