shaba/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-03-26 14:50:08 +03:00
Code

tree: Fix copying of DTDs

Browse Source 
- Don't create multiple DTD nodes.
- Fix UAF if malloc fails.
- Skip DTD nodes if tree module is disabled.

Fixes #583.
This commit is contained in:
Nick Wellnhofer 2023-08-23 20:24:24 +02:00
parent 4e4c89a4bc
commit d39f78069d
1 changed files with 16 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
tree.c
View File

@ -4471,29 +4471,28 @@ xmlNodePtr
xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) {
xmlNodePtr ret = NULL;
xmlNodePtr p = NULL,q;
xmlDtdPtr newSubset = NULL;
while (node != NULL) {
#ifdef LIBXML_TREE_ENABLED
if (node->type == XML_DTD_NODE ) {
if (doc == NULL) {
#ifdef LIBXML_TREE_ENABLED
if ((doc == NULL) || (doc->intSubset != NULL)) {
node = node->next;
continue;
}
if (doc->intSubset == NULL) {
q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node );
if (q == NULL) goto error;
q->doc = doc;
q->parent = parent;
doc->intSubset = (xmlDtdPtr) q;
xmlAddChild(parent, q);
} else {
q = (xmlNodePtr) doc->intSubset;
xmlAddChild(parent, q);
}
} else
q = (xmlNodePtr) xmlCopyDtd( (xmlDtdPtr) node );
if (q == NULL) goto error;
q->doc = doc;
q->parent = parent;
newSubset = (xmlDtdPtr) q;
#else
node = node->next;
continue;
#endif /* LIBXML_TREE_ENABLED */
} else {
q = xmlStaticCopyNode(node, doc, parent, 1);
if (q == NULL) goto error;
if (q == NULL) goto error;
}
if (ret == NULL) {
q->prev = NULL;
ret = p = q;
@ -4505,6 +4504,8 @@ xmlStaticCopyNodeList(xmlNodePtr node, xmlDocPtr doc, xmlNodePtr parent) {
}
node = node->next;
}
if (newSubset != NULL)
doc->intSubset = newSubset;
return(ret);
error:
xmlFreeNodeList(ret);