rsvg-load: Fix use-after-free in xinclude_handler_end() if it were called

Again, this function is not called due to how nested handlers are
being used.
parent 0ce5df47
......@@ -365,14 +365,13 @@ static void
xinclude_handler_end (RsvgSaxHandler * self, const char *name)
{
RsvgSaxHandlerXinclude *z = (RsvgSaxHandlerXinclude *) self;
RsvgSaxHandler *previous = z->prev_handler;
RsvgLoad *load = z->load;
if (!strcmp (name, "include") || !strcmp (name, "xi:include")) {
if (z->load->handler != NULL) {
RsvgSaxHandler *previous_handler;
previous_handler = z->prev_handler;
z->load->handler->free (z->load->handler);
z->load->handler = previous_handler;
if (load->handler != NULL) {
load->handler->free (load->handler);
load->handler = previous;
}
} else if (z->in_fallback) {
if (!strcmp (name, "xi:fallback"))
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment