153aa9179Sopenharmony_ciFrom 1aabc9db40dc5ec1f8f22c09e74c63dda53f7ed6 Mon Sep 17 00:00:00 2001
253aa9179Sopenharmony_ciFrom: Nick Wellnhofer <wellnhofer@aevum.de>
353aa9179Sopenharmony_ciDate: Sun, 22 Jan 2023 13:20:15 +0100
453aa9179Sopenharmony_ciSubject: [PATCH] malloc-fail: Fix null deref in xmlBufResize
553aa9179Sopenharmony_ci
653aa9179Sopenharmony_ciFound with libFuzzer, see #344.
753aa9179Sopenharmony_ci
853aa9179Sopenharmony_ciReference:https://github.com/GNOME/libxml2/commit/1aabc9db40dc5ec1f8f22c09e74c63dda53f7ed6
953aa9179Sopenharmony_ciConflict:NA
1053aa9179Sopenharmony_ci---
1153aa9179Sopenharmony_ci buf.c | 3 ++-
1253aa9179Sopenharmony_ci 1 file changed, 2 insertions(+), 1 deletion(-)
1353aa9179Sopenharmony_ci
1453aa9179Sopenharmony_cidiff --git a/buf.c b/buf.c
1553aa9179Sopenharmony_ciindex e851364..69370b7 100644
1653aa9179Sopenharmony_ci--- a/buf.c
1753aa9179Sopenharmony_ci+++ b/buf.c
1853aa9179Sopenharmony_ci@@ -821,7 +821,8 @@ xmlBufResize(xmlBufPtr buf, size_t size)
1953aa9179Sopenharmony_ci 	if (buf->content == NULL) {
2053aa9179Sopenharmony_ci 	    rebuf = (xmlChar *) xmlMallocAtomic(newSize);
2153aa9179Sopenharmony_ci 	    buf->use = 0;
2253aa9179Sopenharmony_ci-	    rebuf[buf->use] = 0;
2353aa9179Sopenharmony_ci+            if (rebuf != NULL)
2453aa9179Sopenharmony_ci+	        rebuf[buf->use] = 0;
2553aa9179Sopenharmony_ci 	} else if (buf->size - buf->use < 100) {
2653aa9179Sopenharmony_ci 	    rebuf = (xmlChar *) xmlRealloc(buf->content, newSize);
2753aa9179Sopenharmony_ci         } else {
2853aa9179Sopenharmony_ci-- 
2953aa9179Sopenharmony_ci2.27.0
3053aa9179Sopenharmony_ci
31