CVE-2017-5029

The xsltAddTextString function in transform.c in libxslt 1.1.29, as used in
Blink in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux
and 57.0.2987.108 for Android, lacked a check for integer overflow during a
size calculation, which allowed a remote attacker to perform an out of
bounds memory write via a crafted HTML page.

Bugs

• <https://bugzilla.gnome.org/show_bug.cgi?id=777124&gt;
• <https://bugs.chromium.org/p/chromium/issues/detail?id=676623&gt;