1From dee436cd010d7144730526914193bd9fe6c74821 Mon Sep 17 00:00:00 2001
2From: Nick Wellnhofer <wellnhofer@aevum.de>
3Date: Wed, 2 Nov 2022 15:53:52 +0100
4Subject: [PATCH 06/28] malloc-fail: Fix memory leak in xmlNewPropInternal
5
6Also fixes a memory leak if called with a non-element node.
7
8Found with libFuzzer, see #344.
9
10Reference: https://github.com/GNOME/libxml2/commit/fa361de0b759f045c5f6f7f9c09a133abcc074c9
11Conflict: NA
12---
13 tree.c | 3 ++-
14 1 file changed, 2 insertions(+), 1 deletion(-)
15
16diff --git a/tree.c b/tree.c
17index b32561d..6a8c2ea 100644
18--- a/tree.c
19+++ b/tree.c
20@@ -1866,7 +1866,7 @@ xmlNewPropInternal(xmlNodePtr node, xmlNsPtr ns,
21 
22     if ((node != NULL) && (node->type != XML_ELEMENT_NODE)) {
23         if ((eatname == 1) &&
24-	    ((node->doc == NULL) ||
25+	    ((node->doc == NULL) || (node->doc->dict == NULL) ||
26 	     (!(xmlDictOwns(node->doc->dict, name)))))
27             xmlFree((xmlChar *) name);
28         return (NULL);
29@@ -1879,6 +1879,7 @@ xmlNewPropInternal(xmlNodePtr node, xmlNsPtr ns,
30     if (cur == NULL) {
31         if ((eatname == 1) &&
32 	    ((node == NULL) || (node->doc == NULL) ||
33+             (node->doc->dict == NULL) ||
34 	     (!(xmlDictOwns(node->doc->dict, name)))))
35             xmlFree((xmlChar *) name);
36         xmlTreeErrMemory("building attribute");
37-- 
382.27.0
39
40