shaba/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2024-12-24 21:33:51 +03:00
Code

malloc-fail: Fix null deref in xmlXPathTranslateFunction

Browse Source 
Short-lived regression.
This commit is contained in:
Nick Wellnhofer 2023-12-12 15:00:44 +01:00
parent 5c06f4e384
commit 8583b9f1cd
1 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
xpath.c
View File

@ -8392,9 +8392,9 @@ xmlXPathNormalizeFunction(xmlXPathParserContextPtr ctxt, int nargs) {
*/
void
xmlXPathTranslateFunction(xmlXPathParserContextPtr ctxt, int nargs) {
xmlXPathObjectPtr str;
xmlXPathObjectPtr from;
xmlXPathObjectPtr to;
xmlXPathObjectPtr str = NULL;
xmlXPathObjectPtr from = NULL;
xmlXPathObjectPtr to = NULL;
xmlBufPtr target;
int offset, max;
int ch;
@ -8409,6 +8409,8 @@ xmlXPathTranslateFunction(xmlXPathParserContextPtr ctxt, int nargs) {
from = valuePop(ctxt);
CAST_TO_STRING;
str = valuePop(ctxt);
if (ctxt->error != 0)
goto error;
target = xmlBufCreate();
if (target) {
@ -8449,6 +8451,7 @@ xmlXPathTranslateFunction(xmlXPathParserContextPtr ctxt, int nargs) {
}
valuePush(ctxt, xmlXPathCacheNewString(ctxt, xmlBufContent(target)));
xmlBufFree(target);
error:
xmlXPathReleaseObject(ctxt->context, str);
xmlXPathReleaseObject(ctxt->context, from);
xmlXPathReleaseObject(ctxt->context, to);