xml parser: fix a regression in 40082dc/b3874805

Wrongly calculated `limit` could be smaller than `ptr`, causing infinite loop.
koreader · Sep 2, 2024 · 12cba36 · 12cba36
1 parent 287bf21
commit 12cba36
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/crengine/src/lvxml.cpp b/crengine/src/lvxml.cpp
@@ -5749,7 +5749,7 @@ bool LVXMLParser::ReadText()
         const lChar32 *begin = m_read_buffer + m_read_buffer_pos;
         const lChar32 *ptr = begin;
         const lChar32 *end = m_read_buffer + m_read_buffer_len;
-        const lChar32 *limit = m_read_buffer + (TEXT_SPLIT_SIZE - tlen);
+        const lChar32 *limit = begin + (TEXT_SPLIT_SIZE - tlen);
         if (limit > end)
             limit = end;
         // If m_eof (m_read_buffer_pos == m_read_buffer_len), this 'for' won't loop