shaba/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-02-05 05:47:00 +03:00
Code

malloc-fail: Fix null deref in xmlGet{Min,Max}Occurs

Browse Source 
Also report memory error in xmlSchemaGetNodeContent.

Found with libFuzzer, see #344.
This commit is contained in:
Nick Wellnhofer 2023-03-05 14:08:35 +01:00
parent 7762e8eda1
commit 0263b35756
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
xmlschemas.c
View File

@ -4760,6 +4760,8 @@ xmlSchemaGetNodeContent(xmlSchemaParserCtxtPtr ctxt, xmlNodePtr node)
val = xmlStrdup((xmlChar *)"");
ret = xmlDictLookup(ctxt->dict, val, -1);
xmlFree(val);
if (ret == NULL)
xmlSchemaPErrMemory(ctxt, "getting node content", node);
return(ret);
}
@ -6103,6 +6105,8 @@ xmlGetMaxOccurs(xmlSchemaParserCtxtPtr ctxt, xmlNodePtr node,
if (attr == NULL)
return (def);
val = xmlSchemaGetNodeContent(ctxt, (xmlNodePtr) attr);
if (val == NULL)
return (def);
if (xmlStrEqual(val, (const xmlChar *) "unbounded")) {
if (max != UNBOUNDED) {
@ -6177,6 +6181,8 @@ xmlGetMinOccurs(xmlSchemaParserCtxtPtr ctxt, xmlNodePtr node,
if (attr == NULL)
return (def);
val = xmlSchemaGetNodeContent(ctxt, (xmlNodePtr) attr);
if (val == NULL)
return (def);
cur = val;
while (IS_BLANK_CH(*cur))
cur++;