c/libxml2
1
0
Fork 0
mirror of https://gitlab.gnome.org/GNOME/libxml2 synced 2025-03-28 21:33:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix memory leaks in XPointer string-range function

Browse Source 
Found by OSS-Fuzz.
This commit is contained in:
Nick Wellnhofer 2020-10-03 01:13:35 +02:00
parent 0b3c64d9f2
commit 46837d47d5
1 changed files with 27 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
xpointer.c
View File

@ -2706,10 +2706,10 @@ static void
xmlXPtrStringRangeFunction(xmlXPathParserContextPtr ctxt, int nargs) {
int i, startindex, endindex = 0, fendindex;
xmlNodePtr start, end = 0, fend;
xmlXPathObjectPtr set;
xmlXPathObjectPtr set = NULL;
xmlLocationSetPtr oldset;
xmlLocationSetPtr newset;
xmlXPathObjectPtr string;
xmlLocationSetPtr newset = NULL;
xmlXPathObjectPtr string = NULL;
xmlXPathObjectPtr position = NULL;
xmlXPathObjectPtr number = NULL;
int found, pos = 0, num = 0;
@ -2721,29 +2721,39 @@ xmlXPtrStringRangeFunction(xmlXPathParserContextPtr ctxt, int nargs) {
XP_ERROR(XPATH_INVALID_ARITY);
if (nargs >= 4) {
CHECK_TYPE(XPATH_NUMBER);
if ((ctxt->value == NULL) || (ctxt->value->type != XPATH_NUMBER)) {
xmlXPathErr(ctxt, XPATH_INVALID_TYPE);
goto error;
}
number = valuePop(ctxt);
if (number != NULL)
num = (int) number->floatval;
}
if (nargs >= 3) {
CHECK_TYPE(XPATH_NUMBER);
if ((ctxt->value == NULL) || (ctxt->value->type != XPATH_NUMBER)) {
xmlXPathErr(ctxt, XPATH_INVALID_TYPE);
goto error;
}
position = valuePop(ctxt);
if (position != NULL)
pos = (int) position->floatval;
}
CHECK_TYPE(XPATH_STRING);
if ((ctxt->value == NULL) || (ctxt->value->type != XPATH_STRING)) {
xmlXPathErr(ctxt, XPATH_INVALID_TYPE);
goto error;
}
string = valuePop(ctxt);
if ((ctxt->value == NULL) ||
((ctxt->value->type != XPATH_LOCATIONSET) &&
(ctxt->value->type != XPATH_NODESET)))
XP_ERROR(XPATH_INVALID_TYPE)
(ctxt->value->type != XPATH_NODESET))) {
xmlXPathErr(ctxt, XPATH_INVALID_TYPE);
goto error;
}
set = valuePop(ctxt);
newset = xmlXPtrLocationSetCreate(NULL);
if (newset == NULL) {
xmlXPathFreeObject(set);
XP_ERROR(XPATH_MEMORY_ERROR);
xmlXPathErr(ctxt, XPATH_MEMORY_ERROR);
goto error;
}
if (set->nodesetval == NULL) {
goto error;
@ -2756,8 +2766,10 @@ xmlXPtrStringRangeFunction(xmlXPathParserContextPtr ctxt, int nargs) {
*/
tmp = xmlXPtrNewLocationSetNodeSet(set->nodesetval);
xmlXPathFreeObject(set);
if (tmp == NULL)
XP_ERROR(XPATH_MEMORY_ERROR)
if (tmp == NULL) {
xmlXPathErr(ctxt, XPATH_MEMORY_ERROR);
goto error;
}
set = tmp;
}
oldset = (xmlLocationSetPtr) set->user;
@ -2830,7 +2842,8 @@ xmlXPtrStringRangeFunction(xmlXPathParserContextPtr ctxt, int nargs) {
* Save the new value and cleanup
*/
error:
valuePush(ctxt, xmlXPtrWrapLocationSet(newset));
if (newset != NULL)
valuePush(ctxt, xmlXPtrWrapLocationSet(newset));
xmlXPathFreeObject(set);
xmlXPathFreeObject(string);
if (position) xmlXPathFreeObject(position);