lib/libxslt
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxslt synced 2025-08-07 10:42:55 +03:00
Code Activity

Fix memory leaks in EXSLT error paths

Browse Source 
Found with libFuzzer and ASan.
This commit is contained in:
Nick Wellnhofer
2017-05-21 00:16:54 +02:00
parent b89ec93541
commit ac29e4bdcd
3 changed files with 19 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
libexslt/dynamic.c
View File

@@ -113,24 +113,12 @@ exsltDynMapFunction(xmlXPathParserContextPtr ctxt, int nargs)
return;
}
str = xmlXPathPopString(ctxt);
if (xmlXPathCheckError(ctxt)) {
xmlXPathSetTypeError(ctxt);
return;
}
if (xmlXPathCheckError(ctxt))
goto cleanup;
nodeset = xmlXPathPopNodeSet(ctxt);
if (xmlXPathCheckError(ctxt)) {
xmlXPathSetTypeError(ctxt);
return;
}
if (str == NULL || !xmlStrlen(str) || !(comp = xmlXPathCompile(str))) {
if (nodeset != NULL)
xmlXPathFreeNodeSet(nodeset);
if (str != NULL)
xmlFree(str);
valuePush(ctxt, xmlXPathNewNodeSet(NULL));
return;
}
if (xmlXPathCheckError(ctxt))
goto cleanup;
ret = xmlXPathNewNodeSet(NULL);
if (ret == NULL) {
@@ -139,6 +127,9 @@ exsltDynMapFunction(xmlXPathParserContextPtr ctxt, int nargs)
goto cleanup;
}
if (str == NULL || !xmlStrlen(str) || !(comp = xmlXPathCompile(str)))
goto cleanup;
oldDoc = ctxt->context->doc;
oldNode = ctxt->context->node;
oldContextSize = ctxt->context->contextSize;

2
libexslt/functions.c
View File

@@ -540,6 +540,7 @@ exsltFuncFunctionComp (xsltStylesheetPtr style, xmlNodePtr inst) {
xsltGenericError(xsltGenericErrorContext,
"exsltFuncFunctionComp: no stylesheet data\n");
xmlFree(name);
xmlFree(func);
return;
}
@@ -548,6 +549,7 @@ exsltFuncFunctionComp (xsltStylesheetPtr style, xmlNodePtr inst) {
"Failed to register function {%s}%s\n",
ns->href, name);
style->errors++;
xmlFree(func);
} else {
xsltGenericDebug(xsltGenericDebugContext,
"exsltFuncFunctionComp: register {%s}%s\n",

30
libexslt/sets.c
View File

@@ -34,14 +34,12 @@ exsltSetsDifferenceFunction (xmlXPathParserContextPtr ctxt, int nargs) {
}
arg2 = xmlXPathPopNodeSet(ctxt);
if (xmlXPathCheckError(ctxt)) {
xmlXPathSetTypeError(ctxt);
if (xmlXPathCheckError(ctxt))
return;
}
arg1 = xmlXPathPopNodeSet(ctxt);
if (xmlXPathCheckError(ctxt)) {
xmlXPathSetTypeError(ctxt);
xmlXPathFreeNodeSet(arg2);
return;
}
@@ -71,14 +69,12 @@ exsltSetsIntersectionFunction (xmlXPathParserContextPtr ctxt, int nargs) {
}
arg2 = xmlXPathPopNodeSet(ctxt);
if (xmlXPathCheckError(ctxt)) {
xmlXPathSetTypeError(ctxt);
if (xmlXPathCheckError(ctxt))
return;
}
arg1 = xmlXPathPopNodeSet(ctxt);
if (xmlXPathCheckError(ctxt)) {
xmlXPathSetTypeError(ctxt);
xmlXPathFreeNodeSet(arg2);
return;
}
@@ -150,14 +146,12 @@ exsltSetsHasSameNodesFunction (xmlXPathParserContextPtr ctxt,
}
arg2 = xmlXPathPopNodeSet(ctxt);
if (xmlXPathCheckError(ctxt)) {
xmlXPathSetTypeError(ctxt);
if (xmlXPathCheckError(ctxt))
return;
}
arg1 = xmlXPathPopNodeSet(ctxt);
if (xmlXPathCheckError(ctxt)) {
xmlXPathSetTypeError(ctxt);
xmlXPathFreeNodeSet(arg2);
return;
}
@@ -186,14 +180,12 @@ exsltSetsLeadingFunction (xmlXPathParserContextPtr ctxt, int nargs) {
}
arg2 = xmlXPathPopNodeSet(ctxt);
if (xmlXPathCheckError(ctxt)) {
xmlXPathSetTypeError(ctxt);
if (xmlXPathCheckError(ctxt))
return;
}
arg1 = xmlXPathPopNodeSet(ctxt);
if (xmlXPathCheckError(ctxt)) {
xmlXPathSetTypeError(ctxt);
xmlXPathFreeNodeSet(arg2);
return;
}
@@ -233,14 +225,12 @@ exsltSetsTrailingFunction (xmlXPathParserContextPtr ctxt, int nargs) {
}
arg2 = xmlXPathPopNodeSet(ctxt);
if (xmlXPathCheckError(ctxt)) {
xmlXPathSetTypeError(ctxt);
if (xmlXPathCheckError(ctxt))
return;
}
arg1 = xmlXPathPopNodeSet(ctxt);
if (xmlXPathCheckError(ctxt)) {
xmlXPathSetTypeError(ctxt);
xmlXPathFreeNodeSet(arg2);
return;
}