From fa361de0b759f045c5f6f7f9c09a133abcc074c9 Mon Sep 17 00:00:00 2001
From: Nick Wellnhofer <wellnhofer@aevum.de>
Date: Wed, 2 Nov 2022 15:53:52 +0100
Subject: [PATCH] malloc-fail: Fix memory leak in xmlNewPropInternal

Also fixes a memory leak if called with a non-element node.

Found with libFuzzer, see #344.
---
 tree.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tree.c b/tree.c
index 647288ce..b7959443 100644
--- a/tree.c
+++ b/tree.c
@@ -1860,7 +1860,7 @@ xmlNewPropInternal(xmlNodePtr node, xmlNsPtr ns,
 
     if ((node != NULL) && (node->type != XML_ELEMENT_NODE)) {
         if ((eatname == 1) &&
-	    ((node->doc == NULL) ||
+	    ((node->doc == NULL) || (node->doc->dict == NULL) ||
 	     (!(xmlDictOwns(node->doc->dict, name)))))
             xmlFree((xmlChar *) name);
         return (NULL);
@@ -1873,6 +1873,7 @@ xmlNewPropInternal(xmlNodePtr node, xmlNsPtr ns,
     if (cur == NULL) {
         if ((eatname == 1) &&
 	    ((node == NULL) || (node->doc == NULL) ||
+             (node->doc->dict == NULL) ||
 	     (!(xmlDictOwns(node->doc->dict, name)))))
             xmlFree((xmlChar *) name);
         xmlTreeErrMemory("building attribute");