From b8234e8c73335df722b8ec66dbb7d2b82eaa8349 Mon Sep 17 00:00:00 2001
From: Nick Wellnhofer <wellnhofer@aevum.de>
Date: Wed, 19 Feb 2025 12:53:32 +0100
Subject: [PATCH] html: Fix check for partial named character references

Digits are allowed after the first character.
---
 HTMLparser.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/HTMLparser.c b/HTMLparser.c
index 1608d9dc..64a16255 100644
--- a/HTMLparser.c
+++ b/HTMLparser.c
@@ -3229,7 +3229,9 @@ htmlParseCharData(htmlParserCtxtPtr ctxt, int partial) {
                          * &CounterClockwiseContourIntegral; has 33 bytes.
                          */
                         for (i = 1; i < avail; i++) {
-                            if ((i >= 32) || !IS_ASCII_LETTER(in[i])) {
+                            if ((i >= 32) ||
+                                (!IS_ASCII_LETTER(in[i]) &&
+                                 ((i < 2) || !IS_ASCII_DIGIT(in[i])))) {
                                 terminated = 1;
                                 break;
                             }