shaba/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-03-27 18:50:07 +03:00
Code

malloc-fail: Check for malloc failure in xmlHashAddEntry

Browse Source 
Found with libFuzzer, see #344.
This commit is contained in:
Nick Wellnhofer 2023-02-26 15:43:50 +01:00
parent a442d16a5f
commit 4499143a87
1 changed files with 50 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

54
hash.c
View File

@ -611,8 +611,24 @@ xmlHashAddEntry3(xmlHashTablePtr table, const xmlChar *name,
entry->name3 = (xmlChar *) name3;
} else {
entry->name = xmlStrdup(name);
entry->name2 = xmlStrdup(name2);
entry->name3 = xmlStrdup(name3);
if (entry->name == NULL) {
entry->name2 = NULL;
goto error;
}
if (name2 == NULL) {
entry->name2 = NULL;
} else {
entry->name2 = xmlStrdup(name2);
if (entry->name2 == NULL)
goto error;
}
if (name3 == NULL) {
entry->name3 = NULL;
} else {
entry->name3 = xmlStrdup(name3);
if (entry->name3 == NULL)
goto error;
}
}
entry->payload = userdata;
entry->next = NULL;
@ -628,6 +644,13 @@ xmlHashAddEntry3(xmlHashTablePtr table, const xmlChar *name,
xmlHashGrow(table, MAX_HASH_LEN * table->size);
return(0);
error:
xmlFree(entry->name2);
xmlFree(entry->name);
if (insert != NULL)
xmlFree(entry);
return(-1);
}
/**
@ -741,8 +764,24 @@ xmlHashUpdateEntry3(xmlHashTablePtr table, const xmlChar *name,
entry->name3 = (xmlChar *) name3;
} else {
entry->name = xmlStrdup(name);
entry->name2 = xmlStrdup(name2);
entry->name3 = xmlStrdup(name3);
if (entry->name == NULL) {
entry->name2 = NULL;
goto error;
}
if (name2 == NULL) {
entry->name2 = NULL;
} else {
entry->name2 = xmlStrdup(name2);
if (entry->name2 == NULL)
goto error;
}
if (name3 == NULL) {
entry->name3 = NULL;
} else {
entry->name3 = xmlStrdup(name3);
if (entry->name3 == NULL)
goto error;
}
}
entry->payload = userdata;
entry->next = NULL;
@ -754,6 +793,13 @@ xmlHashUpdateEntry3(xmlHashTablePtr table, const xmlChar *name,
insert->next = entry;
}
return(0);
error:
xmlFree(entry->name2);
xmlFree(entry->name);
if (insert != NULL)
xmlFree(entry);
return(-1);
}
/**