Copied from Debian.

From c18f27a58792f7fbd0b30a0ff50d6b40a82f940d Mon Sep 17 00:00:00 2001
From: Geoff McLane <ubuntu@geoffair.info>
Date: Wed, 3 Jun 2015 20:26:03 +0200
Subject: [PATCH] Issue #217 - avoid len going negative, ever...

---
 src/lexer.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/lexer.c b/src/lexer.c
index 376a3d8..664f806 100644
--- a/src/lexer.c
+++ b/src/lexer.c
@@ -3739,16 +3740,17 @@ static tmbstr ParseValue( TidyDocImpl* doc, ctmbstr name,
         /* and prompts attributes unless --literal-attributes is set to yes      */
         /* #994841 - Whitespace is removed from value attributes                 */
 
-        if (munge &&
+        /* Issue #217 - Also only if/while (len > 0) - MUST NEVER GO NEGATIVE! */
+        if ((len > 0) && munge &&
             TY_(tmbstrcasecmp)(name, "alt") &&
             TY_(tmbstrcasecmp)(name, "title") &&
             TY_(tmbstrcasecmp)(name, "value") &&
             TY_(tmbstrcasecmp)(name, "prompt"))
         {
-            while (TY_(IsWhite)(lexer->lexbuf[start+len-1]))
+            while (TY_(IsWhite)(lexer->lexbuf[start+len-1]) && (len > 0))
                 --len;
 
-            while (TY_(IsWhite)(lexer->lexbuf[start]) && start < len)
+            while (TY_(IsWhite)(lexer->lexbuf[start]) && (start < len) && (len > 0))
             {
                 ++start;
                 --len;
ef='/guix/diff/gnu/machine/ssh.scm?id=2ae1c7528d19c61a10f6e3ddfee831ad3fd34e20'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/gnu/machine/ssh.scm'>
<input type='hidden' name='id' value='2ae1c7528d19c61a10f6e3ddfee831ad3fd34e20'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=2ae1c7528d19c61a10f6e3ddfee831ad3fd34e20'>root</a>/<a href='/guix/log/gnu?id=2ae1c7528d19c61a10f6e3ddfee831ad3fd34e20'>gnu</a>/<a href='/guix/log/gnu/machine?id=2ae1c7528d19c61a10f6e3ddfee831ad3fd34e20'>machine</a>/<a href='/guix/log/gnu/machine/ssh.scm?id=2ae1c7528d19c61a10f6e3ddfee831ad3fd34e20'>ssh.scm</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/gnu/machine/ssh.scm?id=2ae1c7528d19c61a10f6e3ddfee831ad3fd34e20&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2019-08-17 20:45:13 +0800'>2019-08-17</span></td><td><a href='/guix/commit/gnu/machine/ssh.scm?id=02460db0474ff5ac0d867ed6d5b192c062af0abc'>machine: ssh: Fix sanity checks.</a><span class='msg-avail'>...</span></td><td>宋文武</td></tr>
<tr><td><span title='2019-08-16 08:47:28 -0400'>2019-08-16</span></td><td><a href='/guix/commit/gnu/machine/ssh.scm?id=4cc5e5204b503afb4536a1e93e2fd7a9f57f12bf'>machine: Use 'become-command'.</a><span class='msg-avail'>...</span></td><td>Jakob L. Kreuze</td></tr>
<tr><td><span title='2019-08-15 07:43:13 -0400'>2019-08-15</span></td><td><a href='/guix/commit/gnu/machine/ssh.scm?id=3033d59ac9a747b42a1fa6ca6664d4fbc62ca117'>machine: Automatically authorize the coordinator's signing key.</a><span class='msg-avail'>...</span></td><td>Jakob L. Kreuze</td></tr>
<tr><td><span title='2019-08-15 07:43:09 -0400'>2019-08-15</span></td><td><a href='/guix/commit/gnu/machine/ssh.scm?id=9c70c460a05b2bc60f3f3602f0a2dba0f79ce86c'>machine: Implement 'roll-back-machine'.</a><span class='msg-avail'>...</span></td><td>Jakob L. Kreuze</td></tr>
<tr><td><span title='2019-08-15 07:43:03 -0400'>2019-08-15</span></td><td><a href='/guix/commit/gnu/machine/ssh.scm?id=5ea7537b9a650cfa525401c19879080a9cf42e13'>machine: Allow non-root users to deploy.</a><span class='msg-avail'>...</span></td><td>Jakob L. Kreuze</td></tr>
<tr><td><span title='2019-08-14 15:38:09 -0400'>2019-08-14</span></td><td><a href='/guix/commit/gnu/machine/ssh.scm?id=2c8e04f13670c8c7ad8c7195c305960dd1905363'>remote: Build derivations appropriate for the remote's</a><span class='msg-avail'>...</span></td><td>Jakob L. Kreuze</td></tr>
<tr><td><span title='2019-08-07 18:29:07 -0400'>2019-08-07</span></td><td><a href='/guix/commit/gnu/machine/ssh.scm?id=d84e9b75b2aba98583531f2876d9298871389585'>machine: Add 'build-locally?' field for managed hosts.</a><span class='msg-avail'>...</span></td><td>Jakob L. Kreuze</td></tr>
<tr><td><span title='2019-08-06 16:40:25 -0400'>2019-08-06</span></td><td><a href='/guix/commit/gnu/machine/ssh.scm?id=fd3119db4fed02a1f3491460be776a3b5d2b2cd3'>machine: Implement safety checks.</a><span class='msg-avail'>...</span></td><td>Jakob L. Kreuze</td></tr>
<tr><td><span title='2019-08-06 15:48:51 -0400'>2019-08-06</span></td><td><a href='/guix/commit/gnu/machine/ssh.scm?id=d97ce20400b5d2967bfbc0e9fbfb99bbb2daed4f'>machine: Rename 'system' field.</a><span class='msg-avail'>...</span></td><td>Jakob L. Kreuze</td></tr>
<tr><td><span title='2019-07-26 19:19:49 +0200'>2019-07-26</span></td><td><a href='/guix/commit/gnu/machine/ssh.scm?id=5c793753b31b1dcd9a554bce953124f7ae88ca9a'>guix system: Add 'reconfigure' module.</a><span class='msg-avail'>...</span></td><td>Jakob L. Kreuze</td></tr>
<tr><td><span title='2019-07-18 12:57:00 +0200'>2019-07-18</span></td><td><a href='/guix/commit/gnu/machine/ssh.scm?id=53f21b3fe9ed57f0feef003185b561efc9b3e30c'>machine: Fix typo.</a><span class='msg-avail'>...</span></td><td>Tobias Geerinckx-Rice</td></tr>
<tr><td><span title='2019-07-06 02:10:04 -0400'>2019-07-06</span></td><td><a href='/guix/commit/gnu/machine/ssh.scm?id=fa9edf09e992db7510c7471486dffc93e1e707e5'>gnu: Add machine type for deployment specifications.</a><span class='msg-avail'>...</span></td><td>Jakob L. Kreuze</td></tr>