153aa9179Sopenharmony_ciFrom ec471ee3202d4434b695e652e1fd5e0dfc592d1b Mon Sep 17 00:00:00 2001
253aa9179Sopenharmony_ciFrom: Nick Wellnhofer <wellnhofer@aevum.de>
353aa9179Sopenharmony_ciDate: Wed, 2 Nov 2022 15:58:31 +0100
453aa9179Sopenharmony_ciSubject: [PATCH 07/28] malloc-fail: Fix memory leak in xmlNewDocNodeEatName
553aa9179Sopenharmony_ci
653aa9179Sopenharmony_ciFound with libFuzzer, see #344.
753aa9179Sopenharmony_ci
853aa9179Sopenharmony_ciReference: https://github.com/GNOME/libxml2/commit/dd50cfeb61c4f74ffc1dca1e818e01cf478e366d
953aa9179Sopenharmony_ciConflict: NA
1053aa9179Sopenharmony_ci---
1153aa9179Sopenharmony_ci tree.c | 5 +++--
1253aa9179Sopenharmony_ci 1 file changed, 3 insertions(+), 2 deletions(-)
1353aa9179Sopenharmony_ci
1453aa9179Sopenharmony_cidiff --git a/tree.c b/tree.c
1553aa9179Sopenharmony_ciindex 6a8c2ea..bb85220 100644
1653aa9179Sopenharmony_ci--- a/tree.c
1753aa9179Sopenharmony_ci+++ b/tree.c
1853aa9179Sopenharmony_ci@@ -2385,8 +2385,9 @@ xmlNewDocNodeEatName(xmlDocPtr doc, xmlNsPtr ns,
1953aa9179Sopenharmony_ci 	}
2053aa9179Sopenharmony_ci     } else {
2153aa9179Sopenharmony_ci         /* if name don't come from the doc dictionary free it here */
2253aa9179Sopenharmony_ci-        if ((name != NULL) && (doc != NULL) &&
2353aa9179Sopenharmony_ci-	    (!(xmlDictOwns(doc->dict, name))))
2453aa9179Sopenharmony_ci+        if ((name != NULL) &&
2553aa9179Sopenharmony_ci+            ((doc == NULL) || (doc->dict == NULL) ||
2653aa9179Sopenharmony_ci+	     (!(xmlDictOwns(doc->dict, name)))))
2753aa9179Sopenharmony_ci 	    xmlFree(name);
2853aa9179Sopenharmony_ci     }
2953aa9179Sopenharmony_ci     return(cur);
3053aa9179Sopenharmony_ci-- 
3153aa9179Sopenharmony_ci2.27.0
3253aa9179Sopenharmony_ci
33