153aa9179Sopenharmony_ciFrom ecba4cbd4335b31aa7a815701971ed09cfffea9b Mon Sep 17 00:00:00 2001
253aa9179Sopenharmony_ciFrom: Nick Wellnhofer <wellnhofer@aevum.de>
353aa9179Sopenharmony_ciDate: Tue, 28 Jun 2022 19:22:31 +0200
453aa9179Sopenharmony_ciSubject: [PATCH] Avoid double-free if malloc fails in inputPush
553aa9179Sopenharmony_ci
653aa9179Sopenharmony_ciIt's the caller's responsibility to free the input stream if this
753aa9179Sopenharmony_cifunction fails.
853aa9179Sopenharmony_ci
953aa9179Sopenharmony_ciReference:https://github.com/GNOME/libxml2/commit/ecba4cbd4335b31aa7a815701971ed09cfffea9b
1053aa9179Sopenharmony_ciConflict:NA
1153aa9179Sopenharmony_ci
1253aa9179Sopenharmony_ci---
1353aa9179Sopenharmony_ci parser.c | 2 --
1453aa9179Sopenharmony_ci 1 file changed, 2 deletions(-)
1553aa9179Sopenharmony_ci
1653aa9179Sopenharmony_cidiff --git a/parser.c b/parser.c
1753aa9179Sopenharmony_ciindex 0d5bcc1..d8225bd 100644
1853aa9179Sopenharmony_ci--- a/parser.c
1953aa9179Sopenharmony_ci+++ b/parser.c
2053aa9179Sopenharmony_ci@@ -1763,9 +1763,7 @@ inputPush(xmlParserCtxtPtr ctxt, xmlParserInputPtr value)
2153aa9179Sopenharmony_ci                                              sizeof(ctxt->inputTab[0]));
2253aa9179Sopenharmony_ci         if (ctxt->inputTab == NULL) {
2353aa9179Sopenharmony_ci             xmlErrMemory(ctxt, NULL);
2453aa9179Sopenharmony_ci-	    xmlFreeInputStream(value);
2553aa9179Sopenharmony_ci 	    ctxt->inputMax /= 2;
2653aa9179Sopenharmony_ci-	    value = NULL;
2753aa9179Sopenharmony_ci             return (-1);
2853aa9179Sopenharmony_ci         }
2953aa9179Sopenharmony_ci     }
3053aa9179Sopenharmony_ci-- 
3153aa9179Sopenharmony_ci2.27.0
3253aa9179Sopenharmony_ci
33