shaba/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2024-10-26 12:25:09 +03:00
Code Releases Activity

malloc-fail: Check for malloc failures when creating XPath strings

Browse Source 
Prevent null derefs.

Found by OSS-Fuzz, see #344.
This commit is contained in:
Nick Wellnhofer 2023-03-18 16:34:01 +01:00
parent 067986fa67
commit b1319c902f
1 changed files with 48 additions and 75 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

123
xpath.c
View File

@ -2494,55 +2494,6 @@ xmlXPathCacheNewNodeSet(xmlXPathContextPtr ctxt, xmlNodePtr val)
return(xmlXPathNewNodeSet(val));
}
/**
* xmlXPathCacheNewCString:
* @ctxt: the XPath context
* @val: the char * value
*
* This is the cached version of xmlXPathNewCString().
* Acquire an xmlXPathObjectPtr of type string and of value @val
*
* Returns the created or reused object.
*/
static xmlXPathObjectPtr
xmlXPathCacheNewCString(xmlXPathContextPtr ctxt, const char *val)
{
if ((ctxt != NULL) && (ctxt->cache)) {
xmlXPathContextCachePtr cache = (xmlXPathContextCachePtr) ctxt->cache;
if ((cache->stringObjs != NULL) &&
(cache->stringObjs->number != 0))
{
xmlXPathObjectPtr ret;
ret = (xmlXPathObjectPtr)
cache->stringObjs->items[--cache->stringObjs->number];
ret->type = XPATH_STRING;
ret->stringval = xmlStrdup(BAD_CAST val);
#ifdef XP_DEBUG_OBJ_USAGE
xmlXPathDebugObjUsageRequested(ctxt, XPATH_STRING);
#endif
return(ret);
} else if ((cache->miscObjs != NULL) &&
(cache->miscObjs->number != 0))
{
xmlXPathObjectPtr ret;
ret = (xmlXPathObjectPtr)
cache->miscObjs->items[--cache->miscObjs->number];
ret->type = XPATH_STRING;
ret->stringval = xmlStrdup(BAD_CAST val);
#ifdef XP_DEBUG_OBJ_USAGE
xmlXPathDebugObjUsageRequested(ctxt, XPATH_STRING);
#endif
return(ret);
}
}
return(xmlXPathNewCString(val));
}
/**
* xmlXPathCacheNewString:
* @ctxt: the XPath context
@ -2563,14 +2514,20 @@ xmlXPathCacheNewString(xmlXPathContextPtr ctxt, const xmlChar *val)
(cache->stringObjs->number != 0))
{
xmlXPathObjectPtr ret;
xmlChar *copy;
if (val == NULL)
val = BAD_CAST "";
copy = xmlStrdup(val);
if (copy == NULL) {
xmlXPathErrMemory(ctxt, NULL);
return(NULL);
}
ret = (xmlXPathObjectPtr)
cache->stringObjs->items[--cache->stringObjs->number];
ret->type = XPATH_STRING;
if (val != NULL)
ret->stringval = xmlStrdup(val);
else
ret->stringval = xmlStrdup((const xmlChar *)"");
ret->stringval = copy;
#ifdef XP_DEBUG_OBJ_USAGE
xmlXPathDebugObjUsageRequested(ctxt, XPATH_STRING);
#endif
@ -2579,15 +2536,21 @@ xmlXPathCacheNewString(xmlXPathContextPtr ctxt, const xmlChar *val)
(cache->miscObjs->number != 0))
{
xmlXPathObjectPtr ret;
xmlChar *copy;
if (val == NULL)
val = BAD_CAST "";
copy = xmlStrdup(val);
if (copy == NULL) {
xmlXPathErrMemory(ctxt, NULL);
return(NULL);
}
ret = (xmlXPathObjectPtr)
cache->miscObjs->items[--cache->miscObjs->number];
ret->type = XPATH_STRING;
if (val != NULL)
ret->stringval = xmlStrdup(val);
else
ret->stringval = xmlStrdup((const xmlChar *)"");
ret->stringval = copy;
#ifdef XP_DEBUG_OBJ_USAGE
xmlXPathDebugObjUsageRequested(ctxt, XPATH_STRING);
#endif
@ -2597,6 +2560,22 @@ xmlXPathCacheNewString(xmlXPathContextPtr ctxt, const xmlChar *val)
return(xmlXPathNewString(val));
}
/**
* xmlXPathCacheNewCString:
* @ctxt: the XPath context
* @val: the char * value
*
* This is the cached version of xmlXPathNewCString().
* Acquire an xmlXPathObjectPtr of type string and of value @val
*
* Returns the created or reused object.
*/
static xmlXPathObjectPtr
xmlXPathCacheNewCString(xmlXPathContextPtr ctxt, const char *val)
{
return xmlXPathCacheNewString(ctxt, BAD_CAST val);
}
/**
* xmlXPathCacheNewBoolean:
* @ctxt: the XPath context
@ -5271,10 +5250,13 @@ xmlXPathNewString(const xmlChar *val) {
}
memset(ret, 0 , sizeof(xmlXPathObject));
ret->type = XPATH_STRING;
if (val != NULL)
ret->stringval = xmlStrdup(val);
else
ret->stringval = xmlStrdup((const xmlChar *)"");
if (val == NULL)
val = BAD_CAST "";
ret->stringval = xmlStrdup(val);
if (ret->stringval == NULL) {
xmlFree(ret);
return(NULL);
}
#ifdef XP_DEBUG_OBJ_USAGE
xmlXPathDebugObjUsageRequested(NULL, XPATH_STRING);
#endif
@ -5320,20 +5302,7 @@ xmlXPathWrapString (xmlChar *val) {
*/
xmlXPathObjectPtr
xmlXPathNewCString(const char *val) {
xmlXPathObjectPtr ret;
ret = (xmlXPathObjectPtr) xmlMalloc(sizeof(xmlXPathObject));
if (ret == NULL) {
xmlXPathErrMemory(NULL, "creating string object\n");
return(NULL);
}
memset(ret, 0 , sizeof(xmlXPathObject));
ret->type = XPATH_STRING;
ret->stringval = xmlStrdup(BAD_CAST val);
#ifdef XP_DEBUG_OBJ_USAGE
xmlXPathDebugObjUsageRequested(NULL, XPATH_STRING);
#endif
return(ret);
return(xmlXPathNewString(BAD_CAST val));
}
/**
@ -5409,6 +5378,10 @@ xmlXPathObjectCopy(xmlXPathObjectPtr val) {
break;
case XPATH_STRING:
ret->stringval = xmlStrdup(val->stringval);
if (ret->stringval == NULL) {
xmlFree(ret);
return(NULL);
}
break;
case XPATH_XSLT_TREE:
#if 0