hitoshura25/cvefixes huggingface dataset:
CVE-2020-11083 (PHP, published 2020-07-14T21:15Z)
Description: value: In October from version 1.0.319 and before version 1.0.466, a user with access to a markdown FormWidget that stores data persistently could create a stored XSS attack against themselves and any other users with access to the generated HTML from the field. This has been fixed in 1.0.466. For users of the RainLab.Blog plugin, this has also been fixed in 1.4.1.
Severity: LOW (CVSS v3 base score: 4.8)
Weakness: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Repository: https://github.com/rainlab/blog-plugin
Files changed:
formwidgets/BlogMarkdown.php
models/Post.php
Commit message: Implement support for backend.allow_unsafe_markdown and improve support for Swoole


Vulnerable code:
            $response->send();
            die();
        }
        catch (Exception $ex) {
            $response->send();

            die();

Fixed code:
    /**
     * {@inheritDoc}
     */
    /**
     * {@inheritDoc}
     */
    /**
     * Disable HTML cleaning on the widget level since the PostModel will handle it
     *
     * @return boolean
     */
    protected function shouldCleanHtml()
    {
        return false;
    }

    /**
     * {@inheritDoc}
     */
    /**
     * Handle images being uploaded to the blog post
     *
     * @return void
     */
            $this->controller->setResponse($response);
        } catch (Exception $ex) {
            $this->controller->setResponse($response);
        // Check to see if the HTML should be cleaned from potential XSS
        $user = BackendAuth::getUser();
        if (!$user || !$user->hasAccess('backend.allow_unsafe_markdown')) {
            $result = Html::clean($result);
        }
CVE-2023-3627 (JSON, published 2023-07-11T17:15Z)
Description: value: Cross-Site Request Forgery (CSRF) in GitHub repository salesagility/suitecrm-core prior to 8.3.1.
Severity: nan (CVSS v3 base score: 8.8)
Weakness: CWE-352 \u2014 Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Repository: https://github.com/salesagility/suitecrm-core
Files changed:
README.md
VERSION
core/app/common/package.json
core/app/core/package.json
core/backend/Security/CSRFValidationListener.php
package.json
Commit message: SuiteCRM 8.3.1 Release


Vulnerable code:
# SuiteCRM 8.3.0
8.3.0
  "version": "8.3.0",
  "version": "8.3.0",
            Request::METHOD_GET === $event->getRequest()->getMethod() ||
  "version": "8.3.0",

Fixed code:
# SuiteCRM 8.3.1
8.3.1
  "version": "8.3.1",
  "version": "8.3.1",
  "version": "8.3.1",
CVE-2013-7456 (C, published 2016-08-07T10:59Z)
Description: value: gd_interpolation.c in the GD Graphics Library (aka libgd) before 2.1.1, as used in PHP before 5.5.36, 5.6.x before 5.6.22, and 7.x before 7.0.7, allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a crafted image that is mishandled by the imagescale function.
Severity: MEDIUM (CVSS v3 base score: 7.6)
Weakness: CWE-125 \u2014 Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Repository: https://github.com/php/php-src
Files changed:
ext/gd/libgd/gd_interpolation.c
ext/gd/tests/bug72227.phpt
Commit message: Fixed bug #72227: imagescale out-of-bounds read

Ported from https://github.com/libgd/libgd/commit/4f65a3e4eedaffa1efcf9ee1eb08f0b504fbc31a


Vulnerable code:
	
	For image rotations, the optimized versions have a lazy antialiasing for 
static inline int _setEdgePixel(const gdImagePtr src, unsigned int x, unsigned int y, gdFixed coverage, const int bgColor) 
        res->ContribRow[u].Left = iLeft;
        res->ContribRow[u].Right = iRight;

	
		

Fixed code:

	For image rotations, the optimized versions have a lazy antialiasing for
static inline int _setEdgePixel(const gdImagePtr src, unsigned int x, unsigned int y, gdFixed coverage, const int bgColor)
        res->ContribRow[u].Left = iLeft;
        res->ContribRow[u].Right = iRight;



--TEST--
Bug #72227: imagescale out-of-bounds read
--SKIPIF--
<?php
	if (!extension_loaded('gd')) die("skip gd extension not available\n");
?>
--FILE--
<?php

$img = imagecreatetruecolor ( 100, 100);
imagescale($img, 13, 1, IMG_BICUBIC);
?>
DONE
--EXPECT--
DONE
CVE-2014-0185 (Other, published 2014-05-06T10:44Z)
Description: value: sapi/fpm/fpm/fpm_unix.c in the FastCGI Process Manager (FPM) in PHP before 5.4.28 and 5.5.x before 5.5.12 uses 0666 permissions for the UNIX socket, which allows local users to gain privileges via a crafted FastCGI client.
Severity: HIGH (CVSS v3 base score: )
Weakness: CWE-269 \u2014 Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Repository: https://github.com/php/php-src
Files changed:
NEWS
sapi/fpm/fpm/fpm_unix.c
sapi/fpm/php-fpm.conf.in
Commit message: Fix bug #67060: use default mode of 660


Vulnerable code:
?? ??? 2014, PHP 5.4.28
	wp->socket_mode = 0666;
;                 mode is set to 0666
;listen.mode = 0666

Fixed code:
01 May 2014, PHP 5.4.28
  . Fixed bug #67060 (sapi/fpm: possible privilege escalation due to insecure 
    default configuration) (CVE-2014-0185). (Stas)
	wp->socket_mode = 0660;
;                 mode is set to 0660
;listen.mode = 0660
CVE-2014-3587 (Other, published 2014-08-23T01:55Z)
Description: value: Integer overflow in the cdf_read_property_info function in cdf.c in file through 5.19, as used in the Fileinfo component in PHP before 5.4.32 and 5.5.x before 5.5.16, allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-1571.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-189 \u2014 Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.
Repository: https://github.com/php/php-src
Files changed:
NEWS
ext/fileinfo/libmagic/cdf.c
Commit message: Fix bug #67716 - Segfault in cdf.c


Vulnerable code:
		if (q > e) {

Fixed code:
  . Fixed bug #67716 (Segfault in cdf.c). (CVE-2014-3587) (Remi)
		if (q < p || q > e) {
CVE-2014-4049 (Unknown, published 2014-06-18T19:55Z)
Description: value: Heap-based buffer overflow in the php_parserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier allows remote servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS TXT record, related to the dns_get_record function.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-119 \u2014 Improper Restriction of Operations within the Bounds of a Memory Buffer
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
Repository: https://github.com/php/php-src
Files changed:
Commit message: Merge branch 'PHP-5.6'

* PHP-5.6:
  Fix potential segfault in dns_get_record()


Vulnerable code:

Fixed code:
CVE-2015-0231 (Other, published 2015-01-27T20:03Z)
Description: value: Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate numerical keys within the serialized properties of an object.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-8142.
Severity: HIGH (CVSS v3 base score: )
Weakness: NVD-CWE-Other \u2014 Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Repository: https://github.com/php/php-src
Files changed:
NEWS
ext/standard/tests/strings/bug68710.phpt
ext/standard/var_unserializer.c
ext/standard/var_unserializer.re
Commit message: Fix for bug #68710 (Use After Free Vulnerability in PHP's unserialize())


Vulnerable code:
/* Generated by re2c 0.13.7.5 on Thu Dec 11 19:26:19 2014 */
			if (zend_symtable_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {
			if (zend_symtable_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {

Fixed code:
- Core:
  . Fix bug #68710 (Use after free vulnerability in unserialize(), incomplete
    fix for #68594). (Stefan Esser)

--TEST--
Bug #68710 Use after free vulnerability in unserialize() (bypassing the
CVE-2014-8142 fix)
--FILE--
<?php
for ($i=4; $i<100; $i++) {
    $m = new StdClass();

    $u = array(1);

    $m->aaa = array(1,2,&$u,4,5);
    $m->bbb = 1;
    $m->ccc = &$u;
    $m->ddd = str_repeat("A", $i);

    $z = serialize($m);
    $z = str_replace("aaa", "123", $z);
    $z = str_replace("bbb", "123", $z);
    $y = unserialize($z);
    $z = serialize($y);
}
?>
===DONE===
--EXPECTF--
===DONE===
/* Generated by re2c 0.13.7.5 on Thu Jan  1 14:43:18 2015 */
			if (zend_hash_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {
			if (zend_hash_find(ht, Z_STRVAL_P(key), Z_STRLEN_P(key) + 1, (void **)&old_data)==SUCCESS) {
CVE-2015-8617 (C, published 2016-01-19T05:59Z)
Description: value: Format string vulnerability in the zend_throw_or_error function in Zend/zend_execute_API.c in PHP 7.x before 7.0.1 allows remote attackers to execute arbitrary code via format string specifiers in a string that is misused as a class name, leading to incorrect error handling.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-134 \u2014 Use of Externally-Controlled Format String
The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
Repository: https://github.com/php/php-src
Files changed:
Zend/zend_execute_API.c
Commit message: Use format string


Vulnerable code:
		zend_throw_error(exception_ce, message);

Fixed code:
		zend_throw_error(exception_ce, "%s", message);
CVE-2015-9253 (C, published 2018-02-19T19:29Z)
Description: value: An issue was discovered in PHP 7.3.x before 7.3.0alpha3, 7.2.x before 7.2.8, and before 7.1.20. The php-fpm master process restarts a child process in an endless loop when using program execution functions (e.g., passthru, exec, shell_exec, or system) with a non-blocking STDIN stream, causing this master process to consume 100% of the CPU, and consume disk space with a large volume of error logs, as demonstrated by an attack by a customer of a shared-hosting facility.
Severity: MEDIUM (CVSS v3 base score: 6.5)
Weakness: CWE-400 \u2014 Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
Repository: https://github.com/php/php-src
Files changed:
NEWS
sapi/fpm/fpm/fpm_children.c
sapi/fpm/fpm/fpm_stdio.c
sapi/fpm/tests/bug73342-nonblocking-stdio.phpt
Commit message: Fixed bug #73342

Directly listen on socket, instead of duping it to STDIN and
listening on that.


Vulnerable code:
	if (wp->listening_socket != STDIN_FILENO) {
		if (0 > dup2(wp->listening_socket, STDIN_FILENO)) {
			zlog(ZLOG_SYSERROR, "failed to init child stdio: dup2()");
			return -1;
		}
	}

Fixed code:
- FPM:
  . Fixed bug #73342 (Vulnerability in php-fpm by changing stdin to
    non-blocking). (Nikita)

	fpm_globals.listening_socket = dup(wp->listening_socket);
--TEST--
FPM: bug73342 - Non-blocking stdin
--SKIPIF--
<?php include "skipif.inc"; ?>
--FILE--
<?php

require_once "tester.inc";

$cfg = <<<EOT
[global]
error_log = {{FILE:LOG}}
[unconfined]
listen = {{ADDR}}
pm = dynamic
pm.max_children = 5
pm.start_servers = 1
pm.min_spare_servers = 1
pm.max_spare_servers = 3
EOT;

$code = <<<EOT
<?php
echo "Before\n";
stream_set_blocking(fopen('php://stdin', 'r'), false);
echo "After\n";
EOT;

$tester = new FPM\Tester($cfg, $code);
$tester->start();
$tester->expectLogStartNotices();
$tester->request()->expectBody("Before\nAfter");
$tester->request()->expectBody("Before\nAfter");
$tester->terminate();
$tester->expectLogTerminatingNotices();
$tester->close();

?>
Done
--EXPECT--
Done
--CLEAN--
<?php
require_once "tester.inc";
FPM\Tester::clean();
?>
CVE-2016-10158 (C, published 2017-01-24T21:59Z)
Description: value: The exif_convert_any_to_int function in ext/exif/exif.c in PHP before 5.6.30, 7.0.x before 7.0.15, and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (application crash) via crafted EXIF data that triggers an attempt to divide the minimum representable negative integer by -1.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-189 \u2014 Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.
Repository: https://github.com/php/php-src
Files changed:
ext/exif/exif.c
ext/exif/tests/bug73737.phpt
Commit message: Fix bug #73737 FPE when parsing a tag format


Vulnerable code:
				return php_ifd_get32s(value, motorola_intel) / s_den;

Fixed code:
				return (size_t)((double)php_ifd_get32s(value, motorola_intel) / s_den);
--TEST--
Bug #73737 (Crash when parsing a tag format)
--SKIPIF--
<?php if (!extension_loaded('exif')) print 'skip exif extension not available';?>
--FILE--
<?php
	$exif = exif_thumbnail(__DIR__ . '/bug73737.tiff');
	var_dump($exif);
?>
--EXPECTF--
Warning: exif_thumbnail(bug73737.tiff): Error in TIFF: filesize(x0030) less than start of IFD dir(x10102) in %s line %d
bool(false)
CVE-2016-10159 (C, published 2017-01-24T21:59Z)
Description: value: Integer overflow in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory consumption or application crash) via a truncated manifest entry in a PHAR archive.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/php/php-src
Files changed:
ext/phar/phar.c
ext/phar/tests/bug73764.phpt
Commit message: Fix int overflows in phar (bug #73764)


Vulnerable code:
		if (buffer + 4 > endbuffer) {
		if (entry.filename_len + 20 > endbuffer - buffer) {

Fixed code:
		if (buffer + 24 > endbuffer) {
		if (entry.filename_len > endbuffer - buffer - 20) {
--TEST--
Phar: PHP bug #73764: Crash while loading hostile phar archive
--SKIPIF--
<?php if (!extension_loaded("phar")) die("skip"); ?>
--FILE--
<?php
chdir(__DIR__);
try {
$p = Phar::LoadPhar('bug73764.phar', 'alias.phar');
echo "OK\n";
} catch(PharException $e) {
	echo $e->getMessage();
}
?>
--EXPECTF--
internal corruption of phar "%sbug73764.phar" (truncated manifest entry)
CVE-2016-10160 (C, published 2017-01-24T21:59Z)
Description: value: Off-by-one error in the phar_parse_pharfile function in ext/phar/phar.c in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-193 \u2014 Off-by-one Error
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
Repository: https://github.com/php/php-src
Files changed:
ext/phar/phar.c
ext/phar/tests/bug73768.phpt
Commit message: Fix bug #73768 - Memory corruption when loading hostile phar


Vulnerable code:
			buffer[tmp_len] = '\0';
				spprintf(error, 0, "cannot load phar \"%s\" with implicit alias \"%s\" under different alias \"%s\"", fname, buffer, alias);

Fixed code:
				spprintf(error, 0, "cannot load phar \"%s\" with implicit alias \"%.*s\" under different alias \"%s\"", fname, tmp_len, buffer, alias);
--TEST--
Phar: PHP bug #73768: Memory corruption when loading hostile phar
--SKIPIF--
<?php if (!extension_loaded("phar")) die("skip"); ?>
--FILE--
<?php
chdir(__DIR__);
try {
$p = Phar::LoadPhar('bug73768.phar', 'alias.phar');
echo "OK\n";
} catch(PharException $e) {
	echo $e->getMessage();
}
?>
--EXPECTF--
cannot load phar "%sbug73768.phar" with implicit alias "" under different alias "alias.phar"
CVE-2016-10162 (C, published 2017-01-24T21:59Z)
Description: value: The php_wddx_pop_element function in ext/wddx/wddx.c in PHP 7.0.x before 7.0.15 and 7.1.x before 7.1.1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an inapplicable class name in a wddxPacket XML document, leading to mishandling in a wddx_deserialize call.
Severity: MEDIUM (CVSS v3 base score: 7.5)
Weakness: CWE-476 \u2014 NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.
Repository: https://github.com/php/php-src
Files changed:
ext/wddx/tests/bug73831.phpt
ext/wddx/wddx.c
Commit message: Fix bug #73831 - NULL Pointer Dereference while unserialize php object


Vulnerable code:
			
							object_init_ex(&obj, pce);

							/* Merge current hashtable with object's default properties */
							zend_hash_merge(Z_OBJPROP(obj),
											Z_ARRVAL(ent2->data),
											zval_add_ref, 0);

							if (incomplete_class) {
								php_store_class_name(&obj, Z_STRVAL(ent1->data), Z_STRLEN(ent1->data));

							/* Clean up old array entry */
							zval_ptr_dtor(&ent2->data);

							/* Set stack entry to point to the newly created object */
							ZVAL_COPY_VALUE(&ent2->data, &obj);

Fixed code:
--TEST--
Bug #73831 (NULL Pointer Dereference while unserialize php object)
--SKIPIF--
<?php if (!extension_loaded("wddx")) print "skip"; ?>
--FILE--
<?php
$xml = <<<EOF
<?xml version="1.0" ?>
<wddxPacket version="1.0">
	<struct>
		<var name="php_class_name">
			<string>Throwable</string>
                </var>
        </struct>
</wddxPacket>
EOF;
try {
	$wddx = wddx_deserialize($xml);
} catch(Error $e) { echo $e->getMessage(); }
?>
--EXPECTF--
Warning: wddx_deserialize(): Class throwable can not be instantiated in %sbug73831.php on line %d
Cannot instantiate interface Throwable

							if (object_init_ex(&obj, pce) != SUCCESS || EG(exception)) {
								zval_ptr_dtor(&ent2->data);
								ZVAL_UNDEF(&ent2->data);
								php_error_docref(NULL, E_WARNING, "Class %s can not be instantiated", Z_STRVAL(ent1->data));
							} else {
								/* Merge current hashtable with object's default properties */
								zend_hash_merge(Z_OBJPROP(obj),
												Z_ARRVAL(ent2->data),
												zval_add_ref, 0);

								if (incomplete_class) {
									php_store_class_name(&obj, Z_STRVAL(ent1->data), Z_STRLEN(ent1->data));
								}

								/* Clean up old array entry */
								zval_ptr_dtor(&ent2->data);

								/* Set stack entry to point to the newly created object */
								ZVAL_COPY_VALUE(&ent2->data, &obj);
CVE-2016-1904 (C, published 2016-01-19T05:59Z)
Description: value: Multiple integer overflows in ext/standard/exec.c in PHP 7.x before 7.0.2 allow remote attackers to cause a denial of service or possibly have unspecified other impact via a long string to the (1) php_escape_shell_cmd or (2) php_escape_shell_arg function, leading to a heap-based buffer overflow.
Severity: HIGH (CVSS v3 base score: 7.3)
Weakness: CWE-189 \u2014 Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.
Repository: https://github.com/php/php-src
Files changed:
ext/standard/exec.c
Commit message: Patch for Heap Buffer Overflow in EscapeShell

Proposed patch for bug #71270


Vulnerable code:
	cmd = zend_string_alloc(2 * l, 0);
	cmd = zend_string_alloc(4 * l + 2, 0); /* worst case */

Fixed code:
	cmd = zend_string_safe_alloc(2, l, 0, 0);
	cmd = zend_string_safe_alloc(4, l, 2, 0); /* worst case */
CVE-2016-3132 (Other, published 2016-08-07T10:59Z)
Description: value: Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arbitrary code via a crafted index.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-415 \u2014 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
Repository: https://github.com/php/php-src
Files changed:
NEWS
ext/spl/spl_dllist.c
ext/spl/tests/bug71735.phpt
Commit message: Fix bug #71735: Double-free in SplDoublyLinkedList::offsetSet


Vulnerable code:
			zval_ptr_dtor(value);

Fixed code:
  . Fixed bug #71735 (Double-free in SplDoublyLinkedList::offsetSet). (Stas)
--TEST--
Bug #71735 (Double-free in SplDoublyLinkedList::offsetSet)
--FILE--
<?php
try {
$var_1=new SplStack();
$var_1->offsetSet(100,new DateTime('2000-01-01'));
} catch(OutOfRangeException $e) {
	print $e->getMessage()."\n";
}
?>
===DONE===
--EXPECT--
Offset invalid or out of range
===DONE===
CVE-2016-5094 (C, published 2016-08-07T10:59Z)
Description: value: Integer overflow in the php_html_entities function in ext/standard/html.c in PHP before 5.5.36 and 5.6.x before 5.6.22 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering a large output string from the htmlspecialchars function.
Severity: HIGH (CVSS v3 base score: 8.6)
Weakness: CWE-190 \u2014 Integer Overflow or Wraparound
The product performs a calculation that can
         produce an integer overflow or wraparound when the logic
         assumes that the resulting value will always be larger than
         the original value. This occurs when an integer value is
         incremented to a value that is too large to store in the
         associated representation. When this occurs, the value may
         become a very small or negative number.
Repository: https://github.com/php/php-src
Files changed:
ext/standard/html.c
Commit message: Fix bug #72135 - don't create strings with lengths outside int range


Vulnerable code:
				
		
	
		} 
		
		
	 * 
 * byte read, no matter if there was success or insuccess. 
			
			 * HTML 5 is the only that has a character that cannot be used in 
		
		
	
	
	
	
empty_source:	
	
		next_char = get_next_char(charset, old, oldlen, cursor, &status); 
	}	
		maxlen = 128;	
			
	

Fixed code:



		}


	 *
 * byte read, no matter if there was success or insuccess.

			 * HTML 5 is the only that has a character that cannot be used in






empty_source:

		next_char = get_next_char(charset, old, oldlen, cursor, &status);
	}
		maxlen = 128;
	if (new_len > INT_MAX) {
		efree(replaced);
		RETURN_FALSE;
	}