Commit 681f094e5bd1d0f6b38b27701d0d1bf1ca7a9a26

Nick Wellnhofer 2020-06-15T15:23:05

Fix unsigned integer overflow in htmlParseTryOrFinish Cast to signed type before subtraction to avoid unsigned integer overflow. Also use ptrdiff_t to avoid potential integer truncation. Found with libFuzzer and UBSan.