153aa9179Sopenharmony_ciFrom 755344013e161ab7c982290c6c78903bd9bd300e Mon Sep 17 00:00:00 2001
253aa9179Sopenharmony_ciFrom: Nick Wellnhofer <wellnhofer@aevum.de>
353aa9179Sopenharmony_ciDate: Mon, 30 Jan 2023 15:40:23 +0100
453aa9179Sopenharmony_ciSubject: [PATCH] malloc-fail: Record malloc failure in xmlXPathCompLiteral
553aa9179Sopenharmony_ci
653aa9179Sopenharmony_ciAvoid OOB array access.
753aa9179Sopenharmony_ci
853aa9179Sopenharmony_ciFound with libFuzzer, see #344.
953aa9179Sopenharmony_ci
1053aa9179Sopenharmony_ciReference:https://github.com/GNOME/libxml2/commit/755344013e161ab7c982290c6c78903bd9bd300e
1153aa9179Sopenharmony_ciConflict:NA
1253aa9179Sopenharmony_ci---
1353aa9179Sopenharmony_ci xpath.c | 5 ++++-
1453aa9179Sopenharmony_ci 1 file changed, 4 insertions(+), 1 deletion(-)
1553aa9179Sopenharmony_ci
1653aa9179Sopenharmony_cidiff --git a/xpath.c b/xpath.c
1753aa9179Sopenharmony_ciindex fcbc7e3..fe0e1e2 100644
1853aa9179Sopenharmony_ci--- a/xpath.c
1953aa9179Sopenharmony_ci+++ b/xpath.c
2053aa9179Sopenharmony_ci@@ -10245,7 +10245,10 @@ xmlXPathCompLiteral(xmlXPathParserContextPtr ctxt) {
2153aa9179Sopenharmony_ci     } else {
2253aa9179Sopenharmony_ci 	XP_ERROR(XPATH_START_LITERAL_ERROR);
2353aa9179Sopenharmony_ci     }
2453aa9179Sopenharmony_ci-    if (ret == NULL) return;
2553aa9179Sopenharmony_ci+    if (ret == NULL) {
2653aa9179Sopenharmony_ci+        xmlXPathPErrMemory(ctxt, NULL);
2753aa9179Sopenharmony_ci+        return;
2853aa9179Sopenharmony_ci+    }
2953aa9179Sopenharmony_ci     lit = xmlXPathCacheNewString(ctxt->context, ret);
3053aa9179Sopenharmony_ci     if (lit == NULL) {
3153aa9179Sopenharmony_ci 	ctxt->error = XPATH_MEMORY_ERROR;
3253aa9179Sopenharmony_ci-- 
3353aa9179Sopenharmony_ci2.27.0
3453aa9179Sopenharmony_ci
35