lib/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2.git synced 2025-10-28 23:14:57 +03:00
Code Activity

malloc-fail: Fix reallocation in xmlXIncludeNewRef

Browse Source 
Avoid null deref.

Found with libFuzzer, see #344.
This commit is contained in:
Nick Wellnhofer
2023-02-03 14:00:13 +01:00
parent d1272c2ed6
commit a3749551e6
1 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
xinclude.c
View File

@@ -272,14 +272,18 @@ xmlXIncludeNewRef(xmlXIncludeCtxtPtr ctxt, const xmlChar *URI,
} }
} }
if (ctxt->incNr >= ctxt->incMax) { if (ctxt->incNr >= ctxt->incMax) {
ctxt->incMax *= 2; xmlXIncludeRefPtr *tmp;
ctxt->incTab = (xmlXIncludeRefPtr *) xmlRealloc(ctxt->incTab, size_t newSize = ctxt->incMax * 2;
ctxt->incMax * sizeof(ctxt->incTab[0]));
if (ctxt->incTab == NULL) { tmp = (xmlXIncludeRefPtr *) xmlRealloc(ctxt->incTab,
newSize * sizeof(ctxt->incTab[0]));
if (tmp == NULL) {
xmlXIncludeErrMemory(ctxt, elem, "growing XInclude context"); xmlXIncludeErrMemory(ctxt, elem, "growing XInclude context");
xmlXIncludeFreeRef(ret); xmlXIncludeFreeRef(ret);
return(NULL); return(NULL);
} }
ctxt->incTab = tmp;
ctxt->incMax *= 2;
} }
ctxt->incTab[ctxt->incNr++] = ret; ctxt->incTab[ctxt->incNr++] = ret;
return(ret); return(ret);