Copied from Debian.

From c18f27a58792f7fbd0b30a0ff50d6b40a82f940d Mon Sep 17 00:00:00 2001
From: Geoff McLane <ubuntu@geoffair.info>
Date: Wed, 3 Jun 2015 20:26:03 +0200
Subject: [PATCH] Issue #217 - avoid len going negative, ever...

---
 src/lexer.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/lexer.c b/src/lexer.c
index 376a3d8..664f806 100644
--- a/src/lexer.c
+++ b/src/lexer.c
@@ -3739,16 +3740,17 @@ static tmbstr ParseValue( TidyDocImpl* doc, ctmbstr name,
         /* and prompts attributes unless --literal-attributes is set to yes      */
         /* #994841 - Whitespace is removed from value attributes                 */
 
-        if (munge &&
+        /* Issue #217 - Also only if/while (len > 0) - MUST NEVER GO NEGATIVE! */
+        if ((len > 0) && munge &&
             TY_(tmbstrcasecmp)(name, "alt") &&
             TY_(tmbstrcasecmp)(name, "title") &&
             TY_(tmbstrcasecmp)(name, "value") &&
             TY_(tmbstrcasecmp)(name, "prompt"))
         {
-            while (TY_(IsWhite)(lexer->lexbuf[start+len-1]))
+            while (TY_(IsWhite)(lexer->lexbuf[start+len-1]) && (len > 0))
                 --len;
 
-            while (TY_(IsWhite)(lexer->lexbuf[start]) && start < len)
+            while (TY_(IsWhite)(lexer->lexbuf[start]) && (start < len) && (len > 0))
             {
                 ++start;
                 --len;
<a href='/guix/diff/gnu/packages/mpi.scm?id=f96097da8ac3a5e0e818608cc4b4848a00362c00'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/gnu/packages/mpi.scm'>
<input type='hidden' name='id' value='f96097da8ac3a5e0e818608cc4b4848a00362c00'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=f96097da8ac3a5e0e818608cc4b4848a00362c00'>root</a>/<a href='/guix/log/gnu?id=f96097da8ac3a5e0e818608cc4b4848a00362c00'>gnu</a>/<a href='/guix/log/gnu/packages?id=f96097da8ac3a5e0e818608cc4b4848a00362c00'>packages</a>/<a href='/guix/log/gnu/packages/mpi.scm?id=f96097da8ac3a5e0e818608cc4b4848a00362c00'>mpi.scm</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/gnu/packages/mpi.scm?id=f96097da8ac3a5e0e818608cc4b4848a00362c00&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2020-03-31 14:55:42 +0200'>2020-03-31</span></td><td><a href='/guix/commit/gnu/packages/mpi.scm?id=06efbe2fbab1475e4f82f410ee5cd27620b23bf4'>gnu: hwloc@2: Update to 2.2.0.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/packages/mpi.scm (hwloc-2): Update to 2.2.0.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2020-03-31 14:55:42 +0200'>2020-03-31</span></td><td><a href='/guix/commit/gnu/packages/mpi.scm?id=8db4e704dc9c6e86c98d7357b85793dea493ff8f'>gnu: hwloc@2: Skip test that fails on emulated hardware.</a><span class='msg-avail'>...<span class='msg-tooltip'>Works around &lt;https://bugs.gnu.org/40342&gt;.

* gnu/packages/mpi.scm (hwloc-2)[arguments]: Add
'skip-test-that-fails-on-qemu' phase.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2020-03-10 22:02:19 +0100'>2020-03-10</span></td><td><a href='/guix/commit/gnu/packages/mpi.scm?id=f9a69e9baed0e9fd5cbf4ed34c63d655a8a530bb'>gnu: openmpi: Use HTTPS home page.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/packages/mpi.scm (openmpi)[home-page]: Use HTTPS.
</span></span></td><td>Tobias Geerinckx-Rice</td></tr>
<tr><td><span title='2020-03-10 22:02:19 +0100'>2020-03-10</span></td><td><a href='/guix/commit/gnu/packages/mpi.scm?id=9dd7082c48c3b3a3f90db974a36dafcac95c5be2'>gnu: openmpi: Update to 4.0.3.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/packages/mpi.scm (openmpi): Update to 4.0.3.
</span></span></td><td>Tobias Geerinckx-Rice</td></tr>
<tr><td><span title='2020-02-17 20:53:16 +0200'>2020-02-17</span></td><td><a href='/guix/commit/gnu/packages/mpi.scm?id=15e62623cc6cd0cff719e1a77f4dbf91d12379a0'>gnu: mpi.scm: Use 'license:' prefix.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/packages/mpi.scm: Import (guix licenses) with the 'license:'
prefix.
</span></span></td><td>Efraim Flashner</td></tr>
<tr><td><span title='2020-02-17 18:22:06 +0100'>2020-02-17</span></td><td><a href='/guix/commit/gnu/packages/mpi.scm?id=c70261bfb993cebc23cd80042de3f52a8b7932a4'>gnu: Add MPICH.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/packages/mpi.scm (mpich): New variable.

Co-authored-by: Ludovic Courtès &lt;ludovic.courtes@inria.fr&gt;
</span></span></td><td>Maurice Brémond</td></tr>