diff options
| author | Nick Wellnhofer <wellnhofer@aevum.de> | 2023-02-26 14:48:23 +0100 |
|---|---|---|
| committer | Nick Wellnhofer <wellnhofer@aevum.de> | 2023-02-27 17:18:02 +0100 |
| commit | a442d16a5fe61626f00f33abe547da9379a37d89 (patch) | |
| tree | 44608e8cbef5ecb2a1dac9ac40aba74a45cf0213 /tree.c | |
| parent | 44947afba0ded433c6f4ffc10ee646c4b267f2b7 (diff) | |
| download | libxml2-a442d16a5fe61626f00f33abe547da9379a37d89.tar.gz | |
malloc-fail: Fix memory leak in xmlGetNsList
Found with libFuzzer, see #344.
Diffstat (limited to 'tree.c')
| -rw-r--r-- | tree.c | 25 |
1 files changed, 9 insertions, 16 deletions
@@ -6034,7 +6034,7 @@ xmlGetNsList(const xmlDoc *doc ATTRIBUTE_UNUSED, const xmlNode *node) xmlNsPtr cur; xmlNsPtr *ret = NULL; int nbns = 0; - int maxns = 10; + int maxns = 0; int i; if ((node == NULL) || (node->type == XML_NAMESPACE_DECL)) @@ -6044,16 +6044,6 @@ xmlGetNsList(const xmlDoc *doc ATTRIBUTE_UNUSED, const xmlNode *node) if (node->type == XML_ELEMENT_NODE) { cur = node->nsDef; while (cur != NULL) { - if (ret == NULL) { - ret = - (xmlNsPtr *) xmlMalloc((maxns + 1) * - sizeof(xmlNsPtr)); - if (ret == NULL) { - xmlTreeErrMemory("getting namespace list"); - return (NULL); - } - ret[nbns] = NULL; - } for (i = 0; i < nbns; i++) { if ((cur->prefix == ret[i]->prefix) || (xmlStrEqual(cur->prefix, ret[i]->prefix))) @@ -6061,15 +6051,18 @@ xmlGetNsList(const xmlDoc *doc ATTRIBUTE_UNUSED, const xmlNode *node) } if (i >= nbns) { if (nbns >= maxns) { - maxns *= 2; - ret = (xmlNsPtr *) xmlRealloc(ret, - (maxns + - 1) * + xmlNsPtr *tmp; + + maxns = maxns ? maxns * 2 : 10; + tmp = (xmlNsPtr *) xmlRealloc(ret, + (maxns + 1) * sizeof(xmlNsPtr)); - if (ret == NULL) { + if (tmp == NULL) { xmlTreeErrMemory("getting namespace list"); + xmlFree(ret); return (NULL); } + ret = tmp; } ret[nbns++] = cur; ret[nbns] = NULL; |