shaba/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-03-31 06:50:06 +03:00
Code

malloc-fail: Fix memory leak in xmlGetNsList

Browse Source 
Found with libFuzzer, see #344.
This commit is contained in:
Nick Wellnhofer 2023-02-26 14:48:23 +01:00
parent 44947afba0
commit a442d16a5f
1 changed files with 9 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
tree.c
View File

@ -6034,7 +6034,7 @@ xmlGetNsList(const xmlDoc *doc ATTRIBUTE_UNUSED, const xmlNode *node)
xmlNsPtr cur;
xmlNsPtr *ret = NULL;
int nbns = 0;
int maxns = 10;
int maxns = 0;
int i;
if ((node == NULL) || (node->type == XML_NAMESPACE_DECL))
@ -6044,16 +6044,6 @@ xmlGetNsList(const xmlDoc *doc ATTRIBUTE_UNUSED, const xmlNode *node)
if (node->type == XML_ELEMENT_NODE) {
cur = node->nsDef;
while (cur != NULL) {
if (ret == NULL) {
ret =
(xmlNsPtr *) xmlMalloc((maxns + 1) *
sizeof(xmlNsPtr));
if (ret == NULL) {
xmlTreeErrMemory("getting namespace list");
return (NULL);
}
ret[nbns] = NULL;
}
for (i = 0; i < nbns; i++) {
if ((cur->prefix == ret[i]->prefix) ||
(xmlStrEqual(cur->prefix, ret[i]->prefix)))
@ -6061,15 +6051,18 @@ xmlGetNsList(const xmlDoc *doc ATTRIBUTE_UNUSED, const xmlNode *node)
}
if (i >= nbns) {
if (nbns >= maxns) {
maxns *= 2;
ret = (xmlNsPtr *) xmlRealloc(ret,
(maxns +
1) *
xmlNsPtr *tmp;
maxns = maxns ? maxns * 2 : 10;
tmp = (xmlNsPtr *) xmlRealloc(ret,
(maxns + 1) *
sizeof(xmlNsPtr));
if (ret == NULL) {
if (tmp == NULL) {
xmlTreeErrMemory("getting namespace list");
xmlFree(ret);
return (NULL);
}
ret = tmp;
}
ret[nbns++] = cur;
ret[nbns] = NULL;