parser.c in libxml2 before 2.9.0, as used in Google
Chrome before 28.0.1500.71 and other products, allows remote
attackers to cause a denial of service (out-of-bounds read)
via a document that ends abruptly, related to the lack of
certain checks for the XML_PARSER_EOF state.