shaba/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-03-21 22:50:08 +03:00
Code

tree: Fix #583 again

Browse Source 
Only set doc->intSubset after successful copy to avoid dangling pointers
in error case.
This commit is contained in:
Nick Wellnhofer 2023-11-28 13:27:25 +01:00
parent de3f70146d
commit 8707838e69
1 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
tree.c
View File

@ -4301,6 +4301,7 @@ xmlNodePtr
xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) {
xmlNodePtr ret = NULL;
xmlNodePtr p = NULL,q;
xmlDtdPtr newSubset = NULL;
while (node != NULL) {
#ifdef LIBXML_TREE_ENABLED
@ -4309,12 +4310,12 @@ xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) {
node = node->next;
continue;
}
if (doc->intSubset == NULL) {
if ((doc->intSubset == NULL) && (newSubset == NULL)) {
q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node );
if (q == NULL) goto error;
q->doc = doc;
q->parent = parent;
doc->intSubset = (xmlDtdPtr) q;
newSubset = (xmlDtdPtr) q;
xmlAddChild(parent, q);
} else {
q = (xmlNodePtr) doc->intSubset;
@ -4335,6 +4336,8 @@ xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) {
}
node = node->next;
}
if ((doc != NULL) && (newSubset != NULL))
doc->intSubset = newSubset;
return(ret);
error:
xmlFreeNodeList(ret);