diff options
author | Nick Wellnhofer <wellnhofer@aevum.de> | 2023-02-26 22:31:33 +0100 |
---|---|---|
committer | Nick Wellnhofer <wellnhofer@aevum.de> | 2023-02-28 13:17:41 +0100 |
commit | 1f3801bc40483d99313d27419fd0b3349d8d7272 (patch) | |
tree | 2d3cf4a99583bf67043dc53429ad35cc2339974a | |
parent | 33edba587ddc7a2d14514f8676c34e9d31d7363f (diff) | |
download | libxslt-1f3801bc40483d99313d27419fd0b3349d8d7272.tar.gz |
malloc-fail: Fix memory leak in exsltSaxonExpressionFunction
Found with libFuzzer, see #84.
-rw-r--r-- | libexslt/saxon.c | 19 |
1 files changed, 12 insertions, 7 deletions
diff --git a/libexslt/saxon.c b/libexslt/saxon.c index 8512c6de..6166b15f 100644 --- a/libexslt/saxon.c +++ b/libexslt/saxon.c @@ -98,13 +98,18 @@ exsltSaxonExpressionFunction (xmlXPathParserContextPtr ctxt, int nargs) { ret = xmlHashLookup(hash, arg); if (ret == NULL) { - ret = xmlXPathCtxtCompile(tctxt->xpathCtxt, arg); - if (ret == NULL) { - xmlFree(arg); - xmlXPathSetError(ctxt, XPATH_EXPR_ERROR); - return; - } - xmlHashAddEntry(hash, arg, (void *) ret); + ret = xmlXPathCtxtCompile(tctxt->xpathCtxt, arg); + if (ret == NULL) { + xmlFree(arg); + xmlXPathSetError(ctxt, XPATH_EXPR_ERROR); + return; + } + if (xmlHashAddEntry(hash, arg, (void *) ret) < 0) { + xmlXPathFreeCompExpr(ret); + xmlFree(arg); + xmlXPathSetError(ctxt, XPATH_MEMORY_ERROR); + return; + } } xmlFree(arg); |