diff options
| author | Nick Wellnhofer <wellnhofer@aevum.de> | 2023-02-26 16:53:35 +0100 |
|---|---|---|
| committer | Nick Wellnhofer <wellnhofer@aevum.de> | 2023-02-26 16:55:37 +0100 |
| commit | 2925103a1612c6225d867d298769bb9ec5c1cb46 (patch) | |
| tree | 2d670e1f5e20bac3c8fd4c552fd69b1b6cb19412 /libxslt | |
| parent | 3e151b2350f2d20649c092bf9d1baf191e03a379 (diff) | |
| download | libxslt-2925103a1612c6225d867d298769bb9ec5c1cb46.tar.gz | |
malloc-fail: Fix null deref after xsltLocalVariablePush
Found with libFuzzer, see #84.
Diffstat (limited to 'libxslt')
| -rw-r--r-- | libxslt/transform.c | 24 |
1 files changed, 8 insertions, 16 deletions
diff --git a/libxslt/transform.c b/libxslt/transform.c index f565e85d..27806785 100644 --- a/libxslt/transform.c +++ b/libxslt/transform.c @@ -2229,26 +2229,18 @@ xsltLocalVariablePush(xsltTransformContextPtr ctxt, xsltStackElemPtr variable, int level) { - if (ctxt->varsMax == 0) { - ctxt->varsMax = 10; - ctxt->varsTab = - (xsltStackElemPtr *) xmlMalloc(ctxt->varsMax * - sizeof(ctxt->varsTab[0])); - if (ctxt->varsTab == NULL) { - xmlGenericError(xmlGenericErrorContext, "malloc failed !\n"); - return (-1); - } - } if (ctxt->varsNr >= ctxt->varsMax) { - ctxt->varsMax *= 2; - ctxt->varsTab = - (xsltStackElemPtr *) xmlRealloc(ctxt->varsTab, - ctxt->varsMax * - sizeof(ctxt->varsTab[0])); - if (ctxt->varsTab == NULL) { + xsltStackElemPtr *tmp; + int newMax = ctxt->varsMax == 0 ? 10 : 2 * ctxt->varsMax; + + tmp = (xsltStackElemPtr *) xmlRealloc(ctxt->varsTab, + newMax * sizeof(*tmp)); + if (tmp == NULL) { xmlGenericError(xmlGenericErrorContext, "realloc failed !\n"); return (-1); } + ctxt->varsTab = tmp; + ctxt->varsMax = newMax; } ctxt->varsTab[ctxt->varsNr++] = variable; ctxt->vars = variable; |