shaba/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2024-12-25 23:21:26 +03:00
Code

malloc-fail: Fix null deref after xmlXIncludeNewRef

Browse Source 
See #344.
This commit is contained in:
Nick Wellnhofer 2023-05-08 17:03:00 +02:00
parent 105ce73da0
commit c40cbf07a3
1 changed files with 2 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
xinclude.c
View File

@ -264,19 +264,9 @@ xmlXIncludeNewRef(xmlXIncludeCtxtPtr ctxt, const xmlChar *URI,
ret->elem = elem; ret->elem = elem;
ret->xml = 0; ret->xml = 0;
ret->inc = NULL; ret->inc = NULL;
if (ctxt->incMax == 0) {
ctxt->incMax = 4;
ctxt->incTab = (xmlXIncludeRefPtr *) xmlMalloc(ctxt->incMax *
sizeof(ctxt->incTab[0]));
if (ctxt->incTab == NULL) {
xmlXIncludeErrMemory(ctxt, elem, "growing XInclude context");
xmlXIncludeFreeRef(ret);
return(NULL);
}
}
if (ctxt->incNr >= ctxt->incMax) { if (ctxt->incNr >= ctxt->incMax) {
xmlXIncludeRefPtr *tmp; xmlXIncludeRefPtr *tmp;
size_t newSize = ctxt->incMax * 2; size_t newSize = ctxt->incMax ? ctxt->incMax * 2 : 4;
tmp = (xmlXIncludeRefPtr *) xmlRealloc(ctxt->incTab, tmp = (xmlXIncludeRefPtr *) xmlRealloc(ctxt->incTab,
newSize * sizeof(ctxt->incTab[0])); newSize * sizeof(ctxt->incTab[0]));
@ -286,7 +276,7 @@ xmlXIncludeNewRef(xmlXIncludeCtxtPtr ctxt, const xmlChar *URI,
return(NULL); return(NULL);
} }
ctxt->incTab = tmp; ctxt->incTab = tmp;
ctxt->incMax *= 2; ctxt->incMax = newSize;
} }
ctxt->incTab[ctxt->incNr++] = ret; ctxt->incTab[ctxt->incNr++] = ret;
return(ret); return(ret);