XML entities leak when SVG fails to parse
Issue Summary
XML entities are leaked when an SVG fails to parse:
247 (144 direct, 103 indirect) bytes in 1 blocks are definitely lost in loss record 1,647 of 1,715
at 0x4842788: malloc (vg_replace_malloc.c:446)
by 0x4B9EF52: xmlCreateEntity (entities.c:158)
by 0x4B9F5B7: xmlNewEntity (entities.c:451)
by 0x4EC555: rsvg::xml::xml2_load::sax_entity_decl_cb (xml2_load.rs:152)
by 0x4BAB3C3: xmlParseEntityDecl (parser.c:5649)
by 0x4BAE564: xmlParseMarkupDecl (parser.c:7026)
by 0x4BAF7F6: xmlParseInternalSubset (parser.c:8560)
by 0x4BB4979: xmlParseDocument (parser.c:11077)
by 0x4EDB76: rsvg::xml::xml2_load::Xml2Parser::parse (xml2_load.rs:466)
by 0x320F79: rsvg::xml::XmlState::parse_from_stream::{{closure}} (mod.rs:628)
by 0x33F8D8: core::result::Result<T,E>::and_then (result.rs:1321)
by 0x4AF4F2: rsvg::xml::XmlState::parse_from_stream (mod.rs:627)
Example SVG
<!DOCTYPEY[<!ENTITY a ''
Librsvg Version
Platform
Reproduced on Arch Linux. Found by OSS-Fuzz.
Additional logs
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=69488 has links to OSS-Fuzz info