shaba/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-03-23 02:50:08 +03:00
Code

malloc-fail: Fix null-deref in xmlPatPushState

Browse Source
This commit is contained in:
Nick Wellnhofer 2024-08-04 11:45:05 +02:00
parent a530ff125d
commit 6e1e22dc5f
1 changed files with 3 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
pattern.c
View File

@ -433,16 +433,11 @@ xmlReversePattern(xmlPatternPtr comp) {
static int
xmlPatPushState(xmlStepStates *states, int step, xmlNodePtr node) {
if ((states->states == NULL) || (states->maxstates <= 0)) {
states->maxstates = 4;
states->nbstates = 0;
states->states = xmlMalloc(4 * sizeof(xmlStepState));
}
else if (states->maxstates <= states->nbstates) {
if (states->maxstates <= states->nbstates) {
size_t newSize = states->maxstates ? states->maxstates * 2 : 4;
xmlStepState *tmp;
tmp = (xmlStepStatePtr) xmlRealloc(states->states,
2 * states->maxstates * sizeof(xmlStepState));
tmp = xmlRealloc(states->states, newSize * sizeof(tmp[0]));
if (tmp == NULL)
return(-1);
states->states = tmp;