lib/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-10-24 13:33:01 +03:00
Code Activity

malloc-fail: Fix memory leak in xmlFAParseCharProp

Browse Source 
Found with libFuzzer, see #344.
This commit is contained in:
Nick Wellnhofer
2023-02-17 15:40:32 +01:00
parent e64653c0e7
commit 40bc1c699a
1 changed files with 16 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
xmlregexp.c
View File

@@ -1238,7 +1238,7 @@ xmlRegPrintCtxt(FILE *output, xmlRegParserCtxtPtr ctxt) {
* * * *
************************************************************************/ ************************************************************************/
static void static xmlRegRangePtr
xmlRegAtomAddRange(xmlRegParserCtxtPtr ctxt, xmlRegAtomPtr atom, xmlRegAtomAddRange(xmlRegParserCtxtPtr ctxt, xmlRegAtomPtr atom,
int neg, xmlRegAtomType type, int start, int end, int neg, xmlRegAtomType type, int start, int end,
xmlChar *blockName) { xmlChar *blockName) {
@@ -1246,11 +1246,11 @@ xmlRegAtomAddRange(xmlRegParserCtxtPtr ctxt, xmlRegAtomPtr atom,
if (atom == NULL) { if (atom == NULL) {
ERROR("add range: atom is NULL"); ERROR("add range: atom is NULL");
return; return(NULL);
} }
if (atom->type != XML_REGEXP_RANGES) { if (atom->type != XML_REGEXP_RANGES) {
ERROR("add range: atom is not ranges"); ERROR("add range: atom is not ranges");
return; return(NULL);
} }
if (atom->maxRanges == 0) { if (atom->maxRanges == 0) {
atom->maxRanges = 4; atom->maxRanges = 4;
@@ -1259,7 +1259,7 @@ xmlRegAtomAddRange(xmlRegParserCtxtPtr ctxt, xmlRegAtomPtr atom,
if (atom->ranges == NULL) { if (atom->ranges == NULL) {
xmlRegexpErrMemory(ctxt, "adding ranges"); xmlRegexpErrMemory(ctxt, "adding ranges");
atom->maxRanges = 0; atom->maxRanges = 0;
return; return(NULL);
} }
} else if (atom->nbRanges >= atom->maxRanges) { } else if (atom->nbRanges >= atom->maxRanges) {
xmlRegRangePtr *tmp; xmlRegRangePtr *tmp;
@@ -1269,16 +1269,17 @@ xmlRegAtomAddRange(xmlRegParserCtxtPtr ctxt, xmlRegAtomPtr atom,
if (tmp == NULL) { if (tmp == NULL) {
xmlRegexpErrMemory(ctxt, "adding ranges"); xmlRegexpErrMemory(ctxt, "adding ranges");
atom->maxRanges /= 2; atom->maxRanges /= 2;
return; return(NULL);
} }
atom->ranges = tmp; atom->ranges = tmp;
} }
range = xmlRegNewRange(ctxt, neg, type, start, end); range = xmlRegNewRange(ctxt, neg, type, start, end);
if (range == NULL) if (range == NULL)
return; return(NULL);
range->blockName = blockName; range->blockName = blockName;
atom->ranges[atom->nbRanges++] = range; atom->ranges[atom->nbRanges++] = range;
return(range);
} }
static int static int
@@ -4883,11 +4884,16 @@ xmlFAParseCharProp(xmlRegParserCtxtPtr ctxt) {
} }
if (ctxt->atom == NULL) { if (ctxt->atom == NULL) {
ctxt->atom = xmlRegNewAtom(ctxt, type); ctxt->atom = xmlRegNewAtom(ctxt, type);
if (ctxt->atom != NULL) if (ctxt->atom == NULL) {
ctxt->atom->valuep = blockName; xmlFree(blockName);
return;
}
ctxt->atom->valuep = blockName;
} else if (ctxt->atom->type == XML_REGEXP_RANGES) { } else if (ctxt->atom->type == XML_REGEXP_RANGES) {
xmlRegAtomAddRange(ctxt, ctxt->atom, ctxt->neg, if (xmlRegAtomAddRange(ctxt, ctxt->atom, ctxt->neg,
type, 0, 0, blockName); type, 0, 0, blockName) == NULL) {
xmlFree(blockName);
}
} }
} }