From 9536fbe7cc733ecf1e430a3eb157d91b0d385538 Mon Sep 17 00:00:00 2001 From: Kirill Str Date: Tue, 16 Jun 2026 08:23:50 +0300 Subject: [PATCH] fix operator precedence bug in XML declaration check Fixes a bug where mixing bitwise `&` and logical `&&` without explicit parentheses caused incorrect operator precedence during XML header validation. --- src/pugixml.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/pugixml.cpp b/src/pugixml.cpp index 451add0ae..7bb7beb1e 100644 --- a/src/pugixml.cpp +++ b/src/pugixml.cpp @@ -2004,7 +2004,7 @@ PUGI_IMPL_NS_BEGIN #define PUGI_IMPL_SCANCHARTYPE(ct) do { while (offset < size && PUGI_IMPL_IS_CHARTYPE(data[offset], ct)) offset++; } while (0) // check if we have a non-empty XML declaration - if (size < 6 || !((data[0] == '<') & (data[1] == '?') & (data[2] == 'x') & (data[3] == 'm') & (data[4] == 'l') && PUGI_IMPL_IS_CHARTYPE(data[5], ct_space))) + if (size < 6 || !(((data[0] == '<') & (data[1] == '?') & (data[2] == 'x') & (data[3] == 'm') & (data[4] == 'l')) && PUGI_IMPL_IS_CHARTYPE(data[5], ct_space))) return false; // scan XML declaration until the encoding field