Nick Wellnhofer 2af3c2a8b9 Fix use-after-free with validating reader ...

Just like IDs, IDREF attributes must be removed from the document's
refs table when they're freed by a reader. This bug is often hidden
because xmlAttr structs are reused and strings are stored in a
dictionary unless XML_PARSE_NODICT is specified.

Found by OSS-Fuzz.

2020-06-08 14:05:42 +02:00

166 KiB

Raw Blame History

View Raw