diff options
| author | Theodore Dubois <tbodt@users.noreply.github.com> | 2017-02-26 15:04:11 -0800 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2017-02-26 15:04:11 -0800 |
| commit | f9bd4e15b5d9cf3ad17b4aec15ea0ebaa68665a5 (patch) | |
| tree | 9fd08d9e34633b39093023313980c2c4c45180ef | |
| parent | 06757b8035af928212d115cc2d768c8d817db4eb (diff) | |
| download | python-lxml-f9bd4e15b5d9cf3ad17b4aec15ea0ebaa68665a5.tar.gz | |
Add check for c_src_dict in _fixThreadDictPtr
If a document is created outside of LXML and converted to an LXML node with elementFactory, its dictionary might be NULL, which would make xmlDictOwns return -1, which counts as true. If the nodes in that document are then moved to an LXML document, fixThreadDictNsForNode would then set the href and prefix pointers to point to the dictionary, which would cause a bad free when the document gets freed.
| -rw-r--r-- | src/lxml/proxy.pxi | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/lxml/proxy.pxi b/src/lxml/proxy.pxi index f10c6cfe..48919084 100644 --- a/src/lxml/proxy.pxi +++ b/src/lxml/proxy.pxi @@ -460,7 +460,7 @@ cdef inline void _fixThreadDictPtr(const_xmlChar** c_ptr, tree.xmlDict* c_src_dict, tree.xmlDict* c_dict) nogil: c_str = c_ptr[0] - if c_str and tree.xmlDictOwns(c_src_dict, c_str): + if c_str and c_src_dict and tree.xmlDictOwns(c_src_dict, c_str): # return value can be NULL on memory error, but we don't handle that here c_str = tree.xmlDictLookup(c_dict, c_str, -1) if c_str: |