malloc-fail: Fix null deref if growing input buffer fails

Also add some error checks.

Found with libFuzzer, see #344.

1 files changed, 2 insertions, 1 deletions

diff --git a/xmlIO.c b/xmlIO.c
index 05800185..d26ddc41 100644
--- a/xmlIO.c
+++ b/xmlIO.c
@@ -3218,7 +3218,8 @@ xmlParserInputBufferGrow(xmlParserInputBufferPtr in, int len) {
         if (res < 0)
             return(-1);
 
-        xmlBufAddLen(buf, res);
+        if (xmlBufAddLen(buf, res) < 0)
+            return(-1);
     }
 
     /*