lib/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-10-23 01:52:48 +03:00
Code Activity

SAX2: Check return value of xmlPushInput

Browse Source 
Fix null deref in case of malloc failure.
This commit is contained in:
Nick Wellnhofer
2024-07-06 15:15:57 +02:00
parent 38195cf596
commit 1e5375c1b4
2 changed files with 7 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
SAX2.c
View File

@@ -320,18 +320,13 @@ xmlSAX2ExternalSubset(void *ctx, const xmlChar *name,
xmlMalloc(5 * sizeof(xmlParserInputPtr)); xmlMalloc(5 * sizeof(xmlParserInputPtr));
if (ctxt->inputTab == NULL) { if (ctxt->inputTab == NULL) {
xmlSAX2ErrMemory(ctxt); xmlSAX2ErrMemory(ctxt);
xmlFreeInputStream(input); goto error;
ctxt->input = oldinput;
ctxt->inputNr = oldinputNr;
ctxt->inputMax = oldinputMax;
ctxt->inputTab = oldinputTab;
ctxt->encoding = oldencoding;
return;
} }
ctxt->inputNr = 0; ctxt->inputNr = 0;
ctxt->inputMax = 5; ctxt->inputMax = 5;
ctxt->input = NULL; ctxt->input = NULL;
xmlPushInput(ctxt, input); if (xmlPushInput(ctxt, input) < 0)
goto error;
if (input->filename == NULL) if (input->filename == NULL)
input->filename = (char *) xmlCanonicPath(SystemID); input->filename = (char *) xmlCanonicPath(SystemID);
@@ -364,7 +359,8 @@ xmlSAX2ExternalSubset(void *ctx, const xmlChar *name,
else else
ctxt->sizeentities += consumed; ctxt->sizeentities += consumed;
xmlFreeInputStream(ctxt->input); error:
xmlFreeInputStream(input);
xmlFree(ctxt->inputTab); xmlFree(ctxt->inputTab);
/* /*

1
parser.c
View File

@@ -2564,6 +2564,7 @@ xmlPushInput(xmlParserCtxtPtr ctxt, xmlParserInputPtr input) {
return(-1); return(-1);
} }
ret = inputPush(ctxt, input); ret = inputPush(ctxt, input);
if (ret >= 0)
GROW; GROW;
return(ret); return(ret);
} }