Copied from Debian.

From c18f27a58792f7fbd0b30a0ff50d6b40a82f940d Mon Sep 17 00:00:00 2001
From: Geoff McLane <ubuntu@geoffair.info>
Date: Wed, 3 Jun 2015 20:26:03 +0200
Subject: [PATCH] Issue #217 - avoid len going negative, ever...

---
 src/lexer.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/lexer.c b/src/lexer.c
index 376a3d8..664f806 100644
--- a/src/lexer.c
+++ b/src/lexer.c
@@ -3739,16 +3740,17 @@ static tmbstr ParseValue( TidyDocImpl* doc, ctmbstr name,
         /* and prompts attributes unless --literal-attributes is set to yes      */
         /* #994841 - Whitespace is removed from value attributes                 */
 
-        if (munge &&
+        /* Issue #217 - Also only if/while (len > 0) - MUST NEVER GO NEGATIVE! */
+        if ((len > 0) && munge &&
             TY_(tmbstrcasecmp)(name, "alt") &&
             TY_(tmbstrcasecmp)(name, "title") &&
             TY_(tmbstrcasecmp)(name, "value") &&
             TY_(tmbstrcasecmp)(name, "prompt"))
         {
-            while (TY_(IsWhite)(lexer->lexbuf[start+len-1]))
+            while (TY_(IsWhite)(lexer->lexbuf[start+len-1]) && (len > 0))
                 --len;
 
-            while (TY_(IsWhite)(lexer->lexbuf[start]) && start < len)
+            while (TY_(IsWhite)(lexer->lexbuf[start]) && (start < len) && (len > 0))
             {
                 ++start;
                 --len;
/union.scm?id=87ce159bc1db935df0f9839c58e505c4a210688c'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/tests/union.scm'>
<input type='hidden' name='id' value='87ce159bc1db935df0f9839c58e505c4a210688c'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=87ce159bc1db935df0f9839c58e505c4a210688c'>root</a>/<a href='/guix/log/tests?id=87ce159bc1db935df0f9839c58e505c4a210688c'>tests</a>/<a href='/guix/log/tests/union.scm?id=87ce159bc1db935df0f9839c58e505c4a210688c'>union.scm</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/tests/union.scm?id=87ce159bc1db935df0f9839c58e505c4a210688c&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2019-06-14 21:57:39 +0200'>2019-06-14</span></td><td><a href='/guix/commit/tests/union.scm?id=03d76577b96ba81c9921eb3a297d42db8644280b'>tests: Make builds less expensive.</a><span class='msg-avail'>...<span class='msg-tooltip'>The switch to the reduced bootstrap broke build time assumptions made by
tests, notably the assumption that GNU-MAKE-BOOT0 was cheap to build.
This commit adjusts this to make these tests cheaper.

* gnu/packages/bootstrap.scm (%bootstrap-inputs-for-tests): New variable.
* guix/tests.scm (gnu-make-for-tests): New variable.
* tests/guix-environment.sh: Use GNU-MAKE-FOR-TESTS instead of
GNU-MAKE-BOOT0.  Remove test with FINDUTILS-BOOT0.
* tests/guix-package-net.sh (boot_make): Use GNU-MAKE-FOR-TESTS.
* tests/packages.scm ("GNU Make, bootstrap"): Likewise.
* tests/profiles.scm ("profile-derivation relative symlinks, two entries"):
Likewise.
* tests/union.scm (%bootstrap-inputs): Remove.
("union-build"): Use %BOOTSTRAP-INPUTS-FOR-TESTS instead of
%BOOTSTRAP-INPUTS.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2018-09-23 09:46:25 +0200'>2018-09-23</span></td><td><a href='/guix/commit/tests/union.scm?id=c362904485d3c8c3f155538ab2f7cd082b334801'>bootstrap: %bootstrap-inputs+toolchain: Replace %bootstrap-inputs.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/packages/commencement.scm (%bootstrap-inputs+toolchain): : New procedure
replacing %bootstrap-inputs to prepare for Mes bootstrap.  Update users.
* tests/union.scm (%bootstrap-inputs): New variable: set to
%bootstrap-inputs+toolchain.
</span></span></td><td>Jan Nieuwenhuizen</td></tr>
<tr><td><span title='2018-09-22 22:40:12 +0200'>2018-09-22</span></td><td><a href='/guix/commit/tests/union.scm?id=a2b2070b679ff7e92d856c7d6775f5f67ce4792d'>bootstrap: %bootstrap-inputs: Wrap input lists into thunks.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/packages/bootstrap.scm (%bootstrap-inputs): Change to procedure.  Update
users; prepares for Mes bootstrap.
* gnu/packages/commencement.scm (%boot0-inputs, %boot1-inputs, %boot2-inputs,
%boot3-inputs, %boot4-inputs, %boot5-inputs, %boot-6-inputs): Change to
procedure.  Update users.
* tests/builders.scm (%bootstrap-inputs, %bootstrap-search-paths): Make a
procedure, filter on package?.  Update users.
</span></span></td><td>Jan Nieuwenhuizen</td></tr>
<tr><td><span title='2018-05-10 14:53:56 +0200'>2018-05-10</span></td><td><a href='/guix/commit/tests/union.scm?id=dac1c97d131d297134fa878ac240d9ec0127044b'>union: Add 'relative-file-name'.</a><span class='msg-avail'>...<span class='msg-tooltip'>* guix/build/union.scm (%not-slash): New variable.
(relative-file-name): New procedure.
* tests/union.scm (test-relative-file-name): New macro and tests.
</span></span></td><td>Ludovic Courtès</td></tr>