From 8810fa330ead0d891a76123f5c43827dfc4aeedc Mon Sep 17 00:00:00 2001
From: Christopher Brannon <chris@the-brannons.com>
Date: Sat, 15 May 2021 05:37:34 -0700
Subject: [PATCH] Fix another out-of-bounds read in SSML parsing.

A malformed tag like <foo could cause espeak to read past
the end of the string.
---
 src/libespeak-ng/readclause.c      | 4 +++-
 tests/ssml/malformed-tag1.expected | 1 +
 tests/ssml/malformed-tag1.ssml     | 1 +
 3 files changed, 5 insertions(+), 1 deletion(-)
 create mode 100644 tests/ssml/malformed-tag1.expected
 create mode 100644 tests/ssml/malformed-tag1.ssml

diff --git a/src/libespeak-ng/readclause.c b/src/libespeak-ng/readclause.c
index 25d51896..64551556 100644
--- a/src/libespeak-ng/readclause.c
+++ b/src/libespeak-ng/readclause.c
@@ -614,7 +614,9 @@ int ReadClause(Translator *tr, char *buf, short *charix, int *charix_top, int n_
 						return terminator;
 					}
 					c1 = ' ';
-					c2 = GetC();
+					if (!Eof()) {
+						c2 = GetC();
+					}
 					continue;
 				}
 			}
diff --git a/tests/ssml/malformed-tag1.expected b/tests/ssml/malformed-tag1.expected
new file mode 100644
index 00000000..8b137891
--- /dev/null
+++ b/tests/ssml/malformed-tag1.expected
@@ -0,0 +1 @@
+
diff --git a/tests/ssml/malformed-tag1.ssml b/tests/ssml/malformed-tag1.ssml
new file mode 100644
index 00000000..e383d9be
--- /dev/null
+++ b/tests/ssml/malformed-tag1.ssml
@@ -0,0 +1 @@
+<<foo