shaba/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-03-27 18:50:07 +03:00
Code

Revert "malloc-fail: Avoid use-after-free after unsuccessful valuePush"

Browse Source 
This reverts commit 6a12be77c6a94c374ab7476087edcee2ba41d9b4.

There's too much code reading ctxt->value directly and making the wrong
assumptions.
This commit is contained in:
Nick Wellnhofer 2023-02-24 16:21:17 +01:00
parent f931178e5f
commit b51478dc95
2 changed files with 2 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
include/libxml/xpathInternals.h
View File

@ -273,8 +273,7 @@ XMLPUBFUN void *
* type.
*/
#define CHECK_TYPE(typeval) \
if ((ctxt->error != 0) || \
(ctxt->value == NULL) || (ctxt->value->type != typeval)) \
if ((ctxt->value == NULL) || (ctxt->value->type != typeval)) \
XP_ERROR(XPATH_INVALID_TYPE)
/**

10
xpath.c
View File

@ -2881,15 +2881,7 @@ valuePop(xmlXPathParserContextPtr ctxt)
{
xmlXPathObjectPtr ret;
/*
* If a memory allocation failed, it can happen that valuePush doesn't
* push a value on the stack. If there's no error check before the
* corresponding valuePop call, we would pop an unrelated object which
* could lead to use-after-free errors later on. So we don't pop values
* if an error was signaled. The stack will be cleaned later in
* xmlXPathFreeParserContext.
*/
if ((ctxt == NULL) || (ctxt->valueNr <= 0) || (ctxt->error != 0))
if ((ctxt == NULL) || (ctxt->valueNr <= 0))
return (NULL);
if (ctxt->valueNr <= ctxt->valueFrame) {