diff options
| author | Nick Wellnhofer <wellnhofer@aevum.de> | 2023-03-23 16:31:45 +0100 |
|---|---|---|
| committer | Nick Wellnhofer <wellnhofer@aevum.de> | 2023-03-23 16:31:45 +0100 |
| commit | aab7eedca3c2dcaa1795d6acba38a4c9811d2a75 (patch) | |
| tree | 9a5b7b57b80a79c0184f6c3fe73ffbd634b6e7c1 | |
| parent | 569328d95d418f10067bb5915147d600986f9058 (diff) | |
| download | libxslt-aab7eedca3c2dcaa1795d6acba38a4c9811d2a75.tar.gz | |
malloc-fail: Fix null deref in xsltKeyFunction
Found by OSS-Fuzz, see #84.
| -rw-r--r-- | libxslt/functions.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/libxslt/functions.c b/libxslt/functions.c index a1484a07..283ff24b 100644 --- a/libxslt/functions.c +++ b/libxslt/functions.c @@ -383,6 +383,12 @@ xsltKeyFunction(xmlXPathParserContextPtr ctxt, int nargs){ xmlXPathObjectPtr newobj, ret; ret = xmlXPathNewNodeSet(NULL); + if (ret == NULL) { + ctxt->error = XPATH_MEMORY_ERROR; + xmlXPathFreeObject(obj1); + xmlXPathFreeObject(obj2); + return; + } if (obj2->nodesetval != NULL) { for (i = 0; i < obj2->nodesetval->nodeNr; i++) { |