Fix memory leak in xmlXIncludeAddNode error paths

Found by OSS-Fuzz.

1 files changed, 5 insertions, 3 deletions

diff --git a/xinclude.c b/xinclude.c
index 90245355..aac30d5b 100644
--- a/xinclude.c
+++ b/xinclude.c
@@ -627,8 +627,8 @@ xmlXIncludeAddNode(xmlXIncludeCtxtPtr ctxt, xmlNodePtr cur) {
 	xmlXIncludeErr(ctxt, cur, XML_XINCLUDE_RECURSION,
 	               "detected a local recursion with no xpointer in %s\n",
 		       URL);
-	if (fragment != NULL)
-	    xmlFree(fragment);
+        xmlFree(URL);
+        xmlFree(fragment);
 	return(-1);
     }
 
@@ -640,12 +640,15 @@ xmlXIncludeAddNode(xmlXIncludeCtxtPtr ctxt, xmlNodePtr cur) {
 	    if (xmlStrEqual(URL, ctxt->urlTab[i])) {
 		xmlXIncludeErr(ctxt, cur, XML_XINCLUDE_RECURSION,
 		               "detected a recursion in %s\n", URL);
+                xmlFree(URL);
+                xmlFree(fragment);
 		return(-1);
 	    }
 	}
     }
 
     ref = xmlXIncludeNewRef(ctxt, URL, cur);
+    xmlFree(URL);
     if (ref == NULL) {
 	return(-1);
     }
@@ -653,7 +656,6 @@ xmlXIncludeAddNode(xmlXIncludeCtxtPtr ctxt, xmlNodePtr cur) {
     ref->doc = NULL;
     ref->xml = xml;
     ref->count = 1;
-    xmlFree(URL);
     return(0);
 }