shaba/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-01-19 10:03:34 +03:00
Code

xmlAddChild() and xmlAddNextSibling() may not attach their second argument

Browse Source 
Use the return value of xmlAddChild() and xmlAddNextSibling()
instead of the second argument directly.

Found by OSS-Fuzz.

Fixes #316
This commit is contained in:
David Kilzer 2021-07-07 19:24:36 -07:00 committed by David Kilzer
parent 53983804ce
commit 8f5ccada05
2 changed files with 12 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
xinclude.c
View File

@ -1014,15 +1014,15 @@ xmlXIncludeCopyRange(xmlXIncludeCtxtPtr ctxt, xmlDocPtr target,
if (list == NULL) {
list = tmp;
listParent = cur->parent;
last = tmp;
} else {
if (level == lastLevel)
xmlAddNextSibling(last, tmp);
last = xmlAddNextSibling(last, tmp);
else {
xmlAddChild(last, tmp);
last = xmlAddChild(last, tmp);
lastLevel = level;
}
}
last = tmp;
if (index2 > 1) {
end = xmlXIncludeGetNthChild(cur, index2 - 1);
@ -1103,12 +1103,11 @@ xmlXIncludeCopyRange(xmlXIncludeCtxtPtr ctxt, xmlDocPtr target,
}
if (tmp != NULL) {
if (level == lastLevel)
xmlAddNextSibling(last, tmp);
last = xmlAddNextSibling(last, tmp);
else {
xmlAddChild(last, tmp);
last = xmlAddChild(last, tmp);
lastLevel = level;
}
last = tmp;
}
}
/*
@ -1186,8 +1185,7 @@ xmlXIncludeCopyXPointer(xmlXIncludeCtxtPtr ctxt, xmlDocPtr target,
if (last == NULL) {
list = last = tmp;
} else {
xmlAddNextSibling(last, tmp);
last = tmp;
last = xmlAddNextSibling(last, tmp);
}
cur = cur->next;
continue;

13
xpointer.c
View File

@ -1483,16 +1483,16 @@ xmlXPtrBuildRangeNodeList(xmlXPathObjectPtr range) {
return(list);
} else {
tmp = xmlCopyNode(cur, 0);
if (list == NULL)
if (list == NULL) {
list = tmp;
else {
parent = tmp;
} else {
if (last != NULL)
xmlAddNextSibling(last, tmp);
parent = xmlAddNextSibling(last, tmp);
else
xmlAddChild(parent, tmp);
parent = xmlAddChild(parent, tmp);
}
last = NULL;
parent = tmp;
if (index2 > 1) {
end = xmlXPtrGetNthChild(cur, index2 - 1);
@ -1574,8 +1574,7 @@ xmlXPtrBuildRangeNodeList(xmlXPathObjectPtr range) {
if (last != NULL)
xmlAddNextSibling(last, tmp);
else {
xmlAddChild(parent, tmp);
last = tmp;
last = xmlAddChild(parent, tmp);
}
}
}