c/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2 synced 2025-03-28 21:33:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

valid: Report malloc failure after xmlRegExecPushString

Browse Source
This commit is contained in:
Nick Wellnhofer 2024-05-05 20:20:22 +02:00
parent 609d2666fa
commit 0651ad667c
2 changed files with 16 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
valid.c
View File

@ -5171,6 +5171,8 @@ xmlValidateElementContent(xmlValidCtxtPtr ctxt, xmlNodePtr child,
}
}
ret = xmlRegExecPushString(exec, NULL, NULL);
if (ret == XML_REGEXP_OUT_OF_MEMORY)
xmlVErrMemory(ctxt);
fail:
xmlRegFreeExecCtxt(exec);
}
@ -5768,6 +5770,9 @@ xmlValidatePopElement(xmlValidCtxtPtr ctxt, xmlDocPtr doc ATTRIBUTE_UNUSED,
if (state->exec != NULL) {
ret = xmlRegExecPushString(state->exec, NULL, NULL);
if (ret <= 0) {
if (ret == XML_REGEXP_OUT_OF_MEMORY)
xmlVErrMemory(ctxt);
else
xmlErrValidNode(ctxt, state->node,
XML_DTD_CONTENT_MODEL,
"Element %s content does not follow the DTD, Expecting more children\n",

13
xmlregexp.c
View File

@ -3500,7 +3500,7 @@ xmlRegFreeExecCtxt(xmlRegExecCtxtPtr exec) {
xmlFree(exec);
}
static void
static int
xmlRegExecSetErrString(xmlRegExecCtxtPtr exec, const xmlChar *value) {
if (exec->errString != NULL)
xmlFree(exec->errString);
@ -3508,10 +3508,13 @@ xmlRegExecSetErrString(xmlRegExecCtxtPtr exec, const xmlChar *value) {
exec->errString = NULL;
} else {
exec->errString = xmlStrdup(value);
if (exec->errString == NULL)
if (exec->errString == NULL) {
exec->status = XML_REGEXP_OUT_OF_MEMORY;
return(-1);
}
}
return(0);
}
static void
xmlFARegExecSaveInputString(xmlRegExecCtxtPtr exec, const xmlChar *value,
@ -3917,7 +3920,8 @@ xmlRegExecPushStringInternal(xmlRegExecCtxtPtr exec, const xmlChar *value,
* entering a sink state, save the current state as error
* state.
*/
xmlRegExecSetErrString(exec, value);
if (xmlRegExecSetErrString(exec, value) < 0)
break;
exec->errState = exec->state;
memcpy(exec->errCounts, exec->counts,
exec->comp->nbCounters * sizeof(int));
@ -3954,7 +3958,8 @@ rollback:
if ((progress) && (exec->state != NULL) &&
(exec->state->type != XML_REGEXP_SINK_STATE)) {
progress = 0;
xmlRegExecSetErrString(exec, value);
if (xmlRegExecSetErrString(exec, value) < 0)
break;
exec->errState = exec->state;
if (exec->comp->nbCounters)
memcpy(exec->errCounts, exec->counts,