Copied from Debian.

From c18f27a58792f7fbd0b30a0ff50d6b40a82f940d Mon Sep 17 00:00:00 2001
From: Geoff McLane <ubuntu@geoffair.info>
Date: Wed, 3 Jun 2015 20:26:03 +0200
Subject: [PATCH] Issue #217 - avoid len going negative, ever...

---
 src/lexer.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/lexer.c b/src/lexer.c
index 376a3d8..664f806 100644
--- a/src/lexer.c
+++ b/src/lexer.c
@@ -3739,16 +3740,17 @@ static tmbstr ParseValue( TidyDocImpl* doc, ctmbstr name,
         /* and prompts attributes unless --literal-attributes is set to yes      */
         /* #994841 - Whitespace is removed from value attributes                 */
 
-        if (munge &&
+        /* Issue #217 - Also only if/while (len > 0) - MUST NEVER GO NEGATIVE! */
+        if ((len > 0) && munge &&
             TY_(tmbstrcasecmp)(name, "alt") &&
             TY_(tmbstrcasecmp)(name, "title") &&
             TY_(tmbstrcasecmp)(name, "value") &&
             TY_(tmbstrcasecmp)(name, "prompt"))
         {
-            while (TY_(IsWhite)(lexer->lexbuf[start+len-1]))
+            while (TY_(IsWhite)(lexer->lexbuf[start+len-1]) && (len > 0))
                 --len;
 
-            while (TY_(IsWhite)(lexer->lexbuf[start]) && start < len)
+            while (TY_(IsWhite)(lexer->lexbuf[start]) && (start < len) && (len > 0))
             {
                 ++start;
                 --len;
dc2d49329748c9ecd78bda3028ae53157a8e'>diff</a></td><td class='form'><form class='right' method='get' action='/guix/log/etc/snippets'>
<input type='hidden' name='id' value='7158dc2d49329748c9ecd78bda3028ae53157a8e'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/guix/log/?id=7158dc2d49329748c9ecd78bda3028ae53157a8e'>root</a>/<a href='/guix/log/etc?id=7158dc2d49329748c9ecd78bda3028ae53157a8e'>etc</a>/<a href='/guix/log/etc/snippets?id=7158dc2d49329748c9ecd78bda3028ae53157a8e'>snippets</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/guix/log/etc/snippets?id=7158dc2d49329748c9ecd78bda3028ae53157a8e&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th></tr>
<tr><td><span title='2019-05-09 00:22:37 -0400'>2019-05-09</span></td><td><a href='/guix/commit/etc/snippets?id=4ac69ea10f54384ac893313ef738e5ad554ac328'>Add (guix bzr-download).</a><span class='msg-avail'>...</span></td><td>Maxim Cournoyer</td></tr>
<tr><td><span title='2019-03-26 14:18:12 +0100'>2019-03-26</span></td><td><a href='/guix/commit/etc/snippets?id=6994e6743603ab73cc32d32786a55672f4fa46f0'>etc: Add "rename" snippet.</a><span class='msg-avail'>...</span></td><td>Pierre Neidhardt</td></tr>
<tr><td><span title='2019-03-08 00:17:30 +0100'>2019-03-08</span></td><td><a href='/guix/commit/etc/snippets?id=95803946c7dbdff88db09fa5fe98e70d607712a7'>etc: snippets: Prefill package name.</a><span class='msg-avail'>...</span></td><td>Ricardo Wurmus</td></tr>
<tr><td><span title='2019-03-07 23:55:24 +0100'>2019-03-07</span></td><td><a href='/guix/commit/etc/snippets?id=d6234620ace1863d8102b065311ef3d94e0931da'>etc: snippets: Prefill package name and version.</a><span class='msg-avail'>...</span></td><td>Ricardo Wurmus</td></tr>
<tr><td><span title='2018-10-10 17:33:42 +0200'>2018-10-10</span></td><td><a href='/guix/commit/etc/snippets?id=d634db9401ac320383d45e24431442259cf6a2a4'>etc: Use git-file-name if origin is git-fetch.</a><span class='msg-avail'>...</span></td><td>Pierre Neidhardt</td></tr>
<tr><td><span title='2018-07-13 12:45:11 +0530'>2018-07-13</span></td><td><a href='/guix/commit/etc/snippets?id=9286c2950494b110e12d58d4ebd693d614120afe'>etc: snippets: Add guix-commit-message-use-https-home-page.</a><span class='msg-avail'>...</span></td><td>Arun Isaac</td></tr>
<tr><td><span title='2018-07-13 09:27:31 +0530'>2018-07-13</span></td><td><a href='/guix/commit/etc/snippets?id=202befb4ae775cfdab1566f4a69ec184406a56be'>etc: snippets: Add new build systems to package snippet.</a><span class='msg-avail'>...</span></td><td>Arun Isaac</td></tr>
<tr><td><span title='2017-12-15 23:15:32 +0100'>2017-12-15</span></td><td><a href='/guix/commit/etc/snippets?id=42cdcdff1945b112452029c6a79445aac15ffd16'>etc: Add snippets.</a><span class='msg-avail'>...</span></td><td>Ricardo Wurmus</td></tr>