1From a3749551e65a8caf146ea2bccf610e718d90bde0 Mon Sep 17 00:00:00 2001
2From: Nick Wellnhofer <wellnhofer@aevum.de>
3Date: Fri, 3 Feb 2023 14:00:13 +0100
4Subject: [PATCH] malloc-fail: Fix reallocation in xmlXIncludeNewRef
5
6Avoid null deref.
7
8Found with libFuzzer, see #344.
9
10Reference:https://github.com/GNOME/libxml2/commit/a3749551e65a8caf146ea2bccf610e718d90bde0
11Conflict:xinclude.c
12---
13 xinclude.c | 12 ++++++++----
14 1 file changed, 8 insertions(+), 4 deletions(-)
15
16diff --git a/xinclude.c b/xinclude.c
17index 60a0d7b..cc486f5 100644
18--- a/xinclude.c
19+++ b/xinclude.c
20@@ -257,14 +257,18 @@ xmlXIncludeNewRef(xmlXIncludeCtxtPtr ctxt, const xmlChar *URI,
21 	}
22     }
23     if (ctxt->incNr >= ctxt->incMax) {
24-	ctxt->incMax *= 2;
25-        ctxt->incTab = (xmlXIncludeRefPtr *) xmlRealloc(ctxt->incTab,
26-	             ctxt->incMax * sizeof(ctxt->incTab[0]));
27-        if (ctxt->incTab == NULL) {
28+        xmlXIncludeRefPtr *tmp;
29+        size_t newSize = ctxt->incMax * 2;
30+
31+        tmp = (xmlXIncludeRefPtr *) xmlRealloc(ctxt->incTab,
32+	             newSize * sizeof(ctxt->incTab[0]));
33+        if (tmp == NULL) {
34 	    xmlXIncludeErrMemory(ctxt, ref, "growing XInclude context");
35 	    xmlXIncludeFreeRef(ret);
36 	    return(NULL);
37 	}
38+        ctxt->incTab = tmp;
39+        ctxt->incMax *= 2;
40     }
41     ctxt->incTab[ctxt->incNr++] = ret;
42     return(ret);
43-- 
442.27.0
45
46