Commit 22324737 authored by Nick Wellnhofer's avatar Nick Wellnhofer

Fix dangling pointer in xsltCopyText

xsltCopyText didn't reset ctxt->lasttext in some cases which could
lead to various memory errors in relation with CDATA sections in input
documents.

Found by OSS-Fuzz.
parent 20cadc71
......@@ -1094,6 +1094,8 @@ xsltCopyText(xsltTransformContextPtr ctxt, xmlNodePtr target,
if ((copy->content = xmlStrdup(cur->content)) == NULL)
return NULL;
}
ctxt->lasttext = NULL;
} else {
/*
* normal processing. keep counters to extend the text node
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment