diff options
| author | Nick Wellnhofer <wellnhofer@aevum.de> | 2023-03-15 15:30:23 +0100 |
|---|---|---|
| committer | Nick Wellnhofer <wellnhofer@aevum.de> | 2023-03-15 15:32:09 +0100 |
| commit | 610206386b0d2fcae0b53229525fb325af1219d2 (patch) | |
| tree | 816ce01b9de1ff1892ad25e5b4e15a86c5231c6e | |
| parent | ac9d752240d399db1d7c09f2ef4008200a272c8c (diff) | |
| download | libxslt-610206386b0d2fcae0b53229525fb325af1219d2.tar.gz | |
malloc-fail: Fix null deref in xsltDocumentFunction
Found by OSS_Fuzz, see #84.
| -rw-r--r-- | libxslt/functions.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libxslt/functions.c b/libxslt/functions.c index 5f657807..f5e5d748 100644 --- a/libxslt/functions.c +++ b/libxslt/functions.c @@ -242,7 +242,7 @@ xsltDocumentFunction(xmlXPathParserContextPtr ctxt, int nargs) obj2 = valuePop(ctxt); } - if (ctxt->value->type == XPATH_NODESET) { + if ((ctxt->value != NULL) && (ctxt->value->type == XPATH_NODESET)) { int i; xmlXPathObjectPtr newobj, ret; @@ -261,6 +261,8 @@ xsltDocumentFunction(xmlXPathParserContextPtr ctxt, int nargs) xmlXPathNewNodeSet(obj->nodesetval-> nodeTab[i])); } + if (ctxt->error) + break; xsltDocumentFunction(ctxt, 2); newobj = valuePop(ctxt); if (newobj != NULL) { |