153aa9179Sopenharmony_ciFrom dee436cd010d7144730526914193bd9fe6c74821 Mon Sep 17 00:00:00 2001
253aa9179Sopenharmony_ciFrom: Nick Wellnhofer <wellnhofer@aevum.de>
353aa9179Sopenharmony_ciDate: Wed, 2 Nov 2022 15:53:52 +0100
453aa9179Sopenharmony_ciSubject: [PATCH 06/28] malloc-fail: Fix memory leak in xmlNewPropInternal
553aa9179Sopenharmony_ci
653aa9179Sopenharmony_ciAlso fixes a memory leak if called with a non-element node.
753aa9179Sopenharmony_ci
853aa9179Sopenharmony_ciFound with libFuzzer, see #344.
953aa9179Sopenharmony_ci
1053aa9179Sopenharmony_ciReference: https://github.com/GNOME/libxml2/commit/fa361de0b759f045c5f6f7f9c09a133abcc074c9
1153aa9179Sopenharmony_ciConflict: NA
1253aa9179Sopenharmony_ci---
1353aa9179Sopenharmony_ci tree.c | 3 ++-
1453aa9179Sopenharmony_ci 1 file changed, 2 insertions(+), 1 deletion(-)
1553aa9179Sopenharmony_ci
1653aa9179Sopenharmony_cidiff --git a/tree.c b/tree.c
1753aa9179Sopenharmony_ciindex b32561d..6a8c2ea 100644
1853aa9179Sopenharmony_ci--- a/tree.c
1953aa9179Sopenharmony_ci+++ b/tree.c
2053aa9179Sopenharmony_ci@@ -1866,7 +1866,7 @@ xmlNewPropInternal(xmlNodePtr node, xmlNsPtr ns,
2153aa9179Sopenharmony_ci 
2253aa9179Sopenharmony_ci     if ((node != NULL) && (node->type != XML_ELEMENT_NODE)) {
2353aa9179Sopenharmony_ci         if ((eatname == 1) &&
2453aa9179Sopenharmony_ci-	    ((node->doc == NULL) ||
2553aa9179Sopenharmony_ci+	    ((node->doc == NULL) || (node->doc->dict == NULL) ||
2653aa9179Sopenharmony_ci 	     (!(xmlDictOwns(node->doc->dict, name)))))
2753aa9179Sopenharmony_ci             xmlFree((xmlChar *) name);
2853aa9179Sopenharmony_ci         return (NULL);
2953aa9179Sopenharmony_ci@@ -1879,6 +1879,7 @@ xmlNewPropInternal(xmlNodePtr node, xmlNsPtr ns,
3053aa9179Sopenharmony_ci     if (cur == NULL) {
3153aa9179Sopenharmony_ci         if ((eatname == 1) &&
3253aa9179Sopenharmony_ci 	    ((node == NULL) || (node->doc == NULL) ||
3353aa9179Sopenharmony_ci+             (node->doc->dict == NULL) ||
3453aa9179Sopenharmony_ci 	     (!(xmlDictOwns(node->doc->dict, name)))))
3553aa9179Sopenharmony_ci             xmlFree((xmlChar *) name);
3653aa9179Sopenharmony_ci         xmlTreeErrMemory("building attribute");
3753aa9179Sopenharmony_ci-- 
3853aa9179Sopenharmony_ci2.27.0
3953aa9179Sopenharmony_ci
40