Copied from Debian.

From c18f27a58792f7fbd0b30a0ff50d6b40a82f940d Mon Sep 17 00:00:00 2001
From: Geoff McLane <ubuntu@geoffair.info>
Date: Wed, 3 Jun 2015 20:26:03 +0200
Subject: [PATCH] Issue #217 - avoid len going negative, ever...

---
 src/lexer.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/lexer.c b/src/lexer.c
index 376a3d8..664f806 100644
--- a/src/lexer.c
+++ b/src/lexer.c
@@ -3739,16 +3740,17 @@ static tmbstr ParseValue( TidyDocImpl* doc, ctmbstr name,
         /* and prompts attributes unless --literal-attributes is set to yes      */
         /* #994841 - Whitespace is removed from value attributes                 */
 
-        if (munge &&
+        /* Issue #217 - Also only if/while (len > 0) - MUST NEVER GO NEGATIVE! */
+        if ((len > 0) && munge &&
             TY_(tmbstrcasecmp)(name, "alt") &&
             TY_(tmbstrcasecmp)(name, "title") &&
             TY_(tmbstrcasecmp)(name, "value") &&
             TY_(tmbstrcasecmp)(name, "prompt"))
         {
-            while (TY_(IsWhite)(lexer->lexbuf[start+len-1]))
+            while (TY_(IsWhite)(lexer->lexbuf[start+len-1]) && (len > 0))
                 --len;
 
-            while (TY_(IsWhite)(lexer->lexbuf[start]) && start < len)
+            while (TY_(IsWhite)(lexer->lexbuf[start]) && (start < len) && (len > 0))
             {
                 ++start;
                 --len;
ef='/guix/diff/gnu/system/hurd.scm?id=8a52db698910f37ae1a53fd59385ac4a4b78b346'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/gnu/system/hurd.scm'>
<input type='hidden' name='id' value='8a52db698910f37ae1a53fd59385ac4a4b78b346'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=8a52db698910f37ae1a53fd59385ac4a4b78b346'>root</a>/<a href='/guix/log/gnu?id=8a52db698910f37ae1a53fd59385ac4a4b78b346'>gnu</a>/<a href='/guix/log/gnu/system?id=8a52db698910f37ae1a53fd59385ac4a4b78b346'>system</a>/<a href='/guix/log/gnu/system/hurd.scm?id=8a52db698910f37ae1a53fd59385ac4a4b78b346'>hurd.scm</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/gnu/system/hurd.scm?id=8a52db698910f37ae1a53fd59385ac4a4b78b346&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2023-03-03 17:55:32 +0100'>2023-03-03</span></td><td><a href='/guix/commit/gnu/system/hurd.scm?id=6edacf249110ce9e59dc44f330d7f03ecd7c60d8'>services: base: Deprecate 'syslog-service' procedure.</a><span class='msg-avail'>...<span class='msg-tooltip'>* doc/guix.texi (Base Services): Replace syslog-service with syslog-service-type.
* gnu/services/base.scm (%default-syslog.conf): Place before &lt;syslog-configuration&gt;.
(syslog-service-type): Set default value.
(syslog-service): Deprecate procedure.
(%base-services): Use syslog-service-type.
* gnu/system/hurd.scm (%base-services/hurd): Ditto.
* gnu/system/install.scm (%installation-services): Ditto.

Signed-off-by: Ludovic Courtès &lt;ludo@gnu.org&gt;
</span></span></td><td>Bruno Victal</td></tr>
<tr><td><span title='2022-11-28 11:19:31 +0100'>2022-11-28</span></td><td><a href='/guix/commit/gnu/system/hurd.scm?id=e3c6575ee93741a43003cd1aa4663151dd90b9f5'>system: hurd: Create more ttys.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/build/hurd-boot.scm (set-hurd-device-translators)[devices]: Add
more /dev/ttyN nodes.
* gnu/system/hurd.scm (%base-services/hurd): Add more
'hurd-getty-service-type' instances.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2022-04-08 18:14:35 +0200'>2022-04-08</span></td><td><a href='/guix/commit/gnu/system/hurd.scm?id=df473496edefbb88eaf2fbff7dda2665eb21b4d1'>system: hurd: Fix bogus 'initrd-modules' field.</a><span class='msg-avail'>...<span class='msg-tooltip'>Reported by kitzman on #guix.

* gnu/system/hurd.scm (%hurd-default-operating-system)[initrd-modules]:
Set to the empty list.
</span></span></td><td>Ludovic Courtès</td></tr>
<tr><td><span title='2022-03-09 23:38:18 +0100'>2022-03-09</span></td><td><a href='/guix/commit/gnu/system/hurd.scm?id=a208a4e923797dcaf6d63dbf2403714d62de8e5a'>system: hurd: Move the Shepherd before the Hurd in %BASE-PACKAGES/HURD.</a><span class='msg-avail'>...<span class='msg-tooltip'>* gnu/system/hurd.scm (%base-packages/hurd): Move SHEPHERD before HURD.
</span></span></td><td>Ludovic Courtès</td></tr>