From ddcb79dc9934fd8a26263f6368c4eb7aa43f6d49 Mon Sep 17 00:00:00 2001
From: Nick Wellnhofer <wellnhofer@aevum.de>
Date: Mon, 20 Jul 2026 02:27:48 +0200
Subject: [PATCH] parser: Fix memory leak in xmlCtxtSetSaxHandler

---
 parserInternals.c | 11 ++---------
 testparser.c      |  9 ++++++---
 2 files changed, 8 insertions(+), 12 deletions(-)

diff --git a/parserInternals.c b/parserInternals.c
index c3eec132d..24e7c5ba3 100644
--- a/parserInternals.c
+++ b/parserInternals.c
@@ -3189,17 +3189,10 @@ xmlCtxtGetSaxHandler(xmlParserCtxt *ctxt) {
  */
 int
 xmlCtxtSetSaxHandler(xmlParserCtxt *ctxt, const xmlSAXHandler *sax) {
-    xmlSAXHandler *copy;
-
-    if ((ctxt == NULL) || (sax == NULL))
+    if ((ctxt == NULL) || (ctxt->sax == NULL) || (sax == NULL))
         return(-1);
 
-    copy = xmlMalloc(sizeof(*copy));
-    if (copy == NULL)
-        return(-1);
-
-    memcpy(copy, sax, sizeof(*copy));
-    ctxt->sax = copy;
+    *ctxt->sax = *sax;
 
     return(0);
 }
diff --git a/testparser.c b/testparser.c
index 30b4eaa42..02f5c5f50 100644
--- a/testparser.c
+++ b/testparser.c
@@ -279,7 +279,7 @@ testSwitchDtdExtSubset(void *vctxt, const xmlChar *name ATTRIBUTE_UNUSED,
                        const xmlChar *systemId ATTRIBUTE_UNUSED) {
     xmlParserCtxtPtr ctxt = vctxt;
 
-    ctxt->myDoc->extSubset = ctxt->_private;
+    ctxt->myDoc->extSubset = xmlCtxtGetPrivate(ctxt);
 }
 
 static int
@@ -291,6 +291,7 @@ testSwitchDtd(void) {
         "<doc>&test;</doc>\n";
     xmlParserInputBufferPtr input;
     xmlParserCtxtPtr ctxt;
+    xmlSAXHandler sax;
     xmlDtdPtr dtd;
     xmlDocPtr doc;
     xmlEntityPtr ent;
@@ -302,8 +303,10 @@ testSwitchDtd(void) {
     dtd = xmlIOParseDTD(NULL, input, XML_CHAR_ENCODING_NONE);
 
     ctxt = xmlNewParserCtxt();
-    ctxt->_private = dtd;
-    ctxt->sax->externalSubset = testSwitchDtdExtSubset;
+    xmlCtxtSetPrivate(ctxt, dtd);
+    xmlSAXVersion(&sax, 2);
+    sax.externalSubset = testSwitchDtdExtSubset;
+    xmlCtxtSetSaxHandler(ctxt, &sax);
     doc = xmlCtxtReadMemory(ctxt, docContent, sizeof(docContent) - 1, NULL,
                             NULL, XML_PARSE_NOENT | XML_PARSE_DTDLOAD);
     xmlFreeParserCtxt(ctxt);