libinjection-issue116-test.patch

libinjection-issue116-test.patch

diff --git a/src/libinjection_html5.c b/src/libinjection_html5.c
index 379bb99..8960dbf 100644
--- a/src/libinjection_html5.c
+++ b/src/libinjection_html5.c
@@ -180,7 +180,17 @@ static int h5_state_tag_open(h5_state_t* hs)
     char ch;
 
     TRACE();
+
+#if 0
+    if (hs->pos >= hs->len) {
+        return 0;
+    }
+#endif
     ch = hs->s[hs->pos];
+    printf("trying to read: %d \n", (int) hs->pos);
+    printf("current size  : %d \n", (int) hs->len);
+    printf("cur. character: %c (0x%02x) \n", ch, ch);
+
     if (ch == CHAR_BANG) {
         hs->pos += 1;
         return h5_state_markup_declaration_open(hs);
diff --git a/src/test-bor.c b/src/test-bor.c
new file mode 100644
index 0000000..b31df10
--- /dev/null
+++ b/src/test-bor.c
@@ -0,0 +1,32 @@
+
+#include "libinjection.h"
+#include "libinjection_xss.h"
+
+/*
+ *
+ * gcc --include stdio.h test-bor.c libinjection_html5.c libinjection_xss.c -o bor
+ *
+ *
+ */
+struct z {
+    char a[5];
+    char b;
+};
+
+int main(int c, char **v)
+{
+    int res;
+    struct z f;
+    f.a[0] = 't';
+    f.a[1] = 'e';
+    f.a[2] = 's';
+    f.a[3] = 't';
+    f.a[4] = '<';
+    f.b = 'z';
+
+    res = libinjection_xss(f.a, 5);
+
+    printf("Result        : %s\n", res?"is xss":"not xss");
+    return 0;
+}
+