malloc-fail: Fix null deref if growing input buffer fails

Also add some error checks.

Found with libFuzzer, see #344.

1 files changed, 2 insertions, 1 deletions

diff --git a/encoding.c b/encoding.c
index 634349a0..3f8dab4b 100644
--- a/encoding.c
+++ b/encoding.c
@@ -2332,7 +2332,8 @@ xmlCharEncInput(xmlParserInputBufferPtr input, int flush)
         toconv = 64 * 1024;
     written = xmlBufAvail(out);
     if (toconv * 2 >= written) {
-        xmlBufGrow(out, toconv * 2);
+        if (xmlBufGrow(out, toconv * 2) < 0)
+            return (-1);
         written = xmlBufAvail(out);
     }
     if ((written > 128 * 1024) && (flush == 0))