lib/libxslt
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxslt synced 2025-08-08 21:42:07 +03:00
Code Activity

Fix memory leaks in EXSLT error paths

Browse Source 
Found with libFuzzer and ASan.
This commit is contained in:
Nick Wellnhofer
2017-05-21 00:16:54 +02:00
parent b89ec93541
commit ac29e4bdcd
3 changed files with 19 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
libexslt/dynamic.c
View File

@@ -113,24 +113,12 @@ exsltDynMapFunction(xmlXPathParserContextPtr ctxt, int nargs)
return; return;
} }
str = xmlXPathPopString(ctxt); str = xmlXPathPopString(ctxt);
if (xmlXPathCheckError(ctxt)) { if (xmlXPathCheckError(ctxt))
xmlXPathSetTypeError(ctxt); goto cleanup;
return;
}
nodeset = xmlXPathPopNodeSet(ctxt); nodeset = xmlXPathPopNodeSet(ctxt);
if (xmlXPathCheckError(ctxt)) { if (xmlXPathCheckError(ctxt))
xmlXPathSetTypeError(ctxt); goto cleanup;
return;
}
if (str == NULL || !xmlStrlen(str) || !(comp = xmlXPathCompile(str))) {
if (nodeset != NULL)
xmlXPathFreeNodeSet(nodeset);
if (str != NULL)
xmlFree(str);
valuePush(ctxt, xmlXPathNewNodeSet(NULL));
return;
}
ret = xmlXPathNewNodeSet(NULL); ret = xmlXPathNewNodeSet(NULL);
if (ret == NULL) { if (ret == NULL) {
@@ -139,6 +127,9 @@ exsltDynMapFunction(xmlXPathParserContextPtr ctxt, int nargs)
goto cleanup; goto cleanup;
} }
if (str == NULL || !xmlStrlen(str) || !(comp = xmlXPathCompile(str)))
goto cleanup;
oldDoc = ctxt->context->doc; oldDoc = ctxt->context->doc;
oldNode = ctxt->context->node; oldNode = ctxt->context->node;
oldContextSize = ctxt->context->contextSize; oldContextSize = ctxt->context->contextSize;

2
libexslt/functions.c
View File

@@ -540,6 +540,7 @@ exsltFuncFunctionComp (xsltStylesheetPtr style, xmlNodePtr inst) {
xsltGenericError(xsltGenericErrorContext, xsltGenericError(xsltGenericErrorContext,
"exsltFuncFunctionComp: no stylesheet data\n"); "exsltFuncFunctionComp: no stylesheet data\n");
xmlFree(name); xmlFree(name);
xmlFree(func);
return; return;
} }
@@ -548,6 +549,7 @@ exsltFuncFunctionComp (xsltStylesheetPtr style, xmlNodePtr inst) {
"Failed to register function {%s}%s\n", "Failed to register function {%s}%s\n",
ns->href, name); ns->href, name);
style->errors++; style->errors++;
xmlFree(func);
} else { } else {
xsltGenericDebug(xsltGenericDebugContext, xsltGenericDebug(xsltGenericDebugContext,
"exsltFuncFunctionComp: register {%s}%s\n", "exsltFuncFunctionComp: register {%s}%s\n",

30
libexslt/sets.c
View File

@@ -34,14 +34,12 @@ exsltSetsDifferenceFunction (xmlXPathParserContextPtr ctxt, int nargs) {
} }
arg2 = xmlXPathPopNodeSet(ctxt); arg2 = xmlXPathPopNodeSet(ctxt);
if (xmlXPathCheckError(ctxt)) { if (xmlXPathCheckError(ctxt))
xmlXPathSetTypeError(ctxt);
return; return;
}
arg1 = xmlXPathPopNodeSet(ctxt); arg1 = xmlXPathPopNodeSet(ctxt);
if (xmlXPathCheckError(ctxt)) { if (xmlXPathCheckError(ctxt)) {
xmlXPathSetTypeError(ctxt); xmlXPathFreeNodeSet(arg2);
return; return;
} }
@@ -71,14 +69,12 @@ exsltSetsIntersectionFunction (xmlXPathParserContextPtr ctxt, int nargs) {
} }
arg2 = xmlXPathPopNodeSet(ctxt); arg2 = xmlXPathPopNodeSet(ctxt);
if (xmlXPathCheckError(ctxt)) { if (xmlXPathCheckError(ctxt))
xmlXPathSetTypeError(ctxt);
return; return;
}
arg1 = xmlXPathPopNodeSet(ctxt); arg1 = xmlXPathPopNodeSet(ctxt);
if (xmlXPathCheckError(ctxt)) { if (xmlXPathCheckError(ctxt)) {
xmlXPathSetTypeError(ctxt); xmlXPathFreeNodeSet(arg2);
return; return;
} }
@@ -150,14 +146,12 @@ exsltSetsHasSameNodesFunction (xmlXPathParserContextPtr ctxt,
} }
arg2 = xmlXPathPopNodeSet(ctxt); arg2 = xmlXPathPopNodeSet(ctxt);
if (xmlXPathCheckError(ctxt)) { if (xmlXPathCheckError(ctxt))
xmlXPathSetTypeError(ctxt);
return; return;
}
arg1 = xmlXPathPopNodeSet(ctxt); arg1 = xmlXPathPopNodeSet(ctxt);
if (xmlXPathCheckError(ctxt)) { if (xmlXPathCheckError(ctxt)) {
xmlXPathSetTypeError(ctxt); xmlXPathFreeNodeSet(arg2);
return; return;
} }
@@ -186,14 +180,12 @@ exsltSetsLeadingFunction (xmlXPathParserContextPtr ctxt, int nargs) {
} }
arg2 = xmlXPathPopNodeSet(ctxt); arg2 = xmlXPathPopNodeSet(ctxt);
if (xmlXPathCheckError(ctxt)) { if (xmlXPathCheckError(ctxt))
xmlXPathSetTypeError(ctxt);
return; return;
}
arg1 = xmlXPathPopNodeSet(ctxt); arg1 = xmlXPathPopNodeSet(ctxt);
if (xmlXPathCheckError(ctxt)) { if (xmlXPathCheckError(ctxt)) {
xmlXPathSetTypeError(ctxt); xmlXPathFreeNodeSet(arg2);
return; return;
} }
@@ -233,14 +225,12 @@ exsltSetsTrailingFunction (xmlXPathParserContextPtr ctxt, int nargs) {
} }
arg2 = xmlXPathPopNodeSet(ctxt); arg2 = xmlXPathPopNodeSet(ctxt);
if (xmlXPathCheckError(ctxt)) { if (xmlXPathCheckError(ctxt))
xmlXPathSetTypeError(ctxt);
return; return;
}
arg1 = xmlXPathPopNodeSet(ctxt); arg1 = xmlXPathPopNodeSet(ctxt);
if (xmlXPathCheckError(ctxt)) { if (xmlXPathCheckError(ctxt)) {
xmlXPathSetTypeError(ctxt); xmlXPathFreeNodeSet(arg2);
return; return;
} }