Commit 5a02583c authored by Zhipeng Xie's avatar Zhipeng Xie Committed by Nick Wellnhofer

Fix memory leak in xmlParseBalancedChunkMemoryRecover

When doc is NULL, namespace created in xmlTreeEnsureXMLDecl
is bind to newDoc->oldNs, in this case, set newDoc->oldNs to
NULL and free newDoc will cause a memory leak.

Found with libFuzzer.

Closes #82.
parent 09b6f818
...@@ -13894,7 +13894,8 @@ xmlParseBalancedChunkMemoryRecover(xmlDocPtr doc, xmlSAXHandlerPtr sax, ...@@ -13894,7 +13894,8 @@ xmlParseBalancedChunkMemoryRecover(xmlDocPtr doc, xmlSAXHandlerPtr sax,
xmlFreeParserCtxt(ctxt); xmlFreeParserCtxt(ctxt);
newDoc->intSubset = NULL; newDoc->intSubset = NULL;
newDoc->extSubset = NULL; newDoc->extSubset = NULL;
newDoc->oldNs = NULL; if(doc != NULL)
newDoc->oldNs = NULL;
xmlFreeDoc(newDoc); xmlFreeDoc(newDoc);
return(ret); return(ret);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment