1From c40cbf07a30c264846ad1135a3670535942441f6 Mon Sep 17 00:00:00 2001 2From: Nick Wellnhofer <wellnhofer@aevum.de> 3Date: Mon, 8 May 2023 17:03:00 +0200 4Subject: [PATCH] malloc-fail: Fix null deref after xmlXIncludeNewRef 5 6See #344. 7 8Reference:https://github.com/GNOME/libxml2/commit/c40cbf07a30c264846ad1135a3670535942441f6 9Conflict:xinclude.c 10 11--- 12 xinclude.c | 14 ++------------ 13 1 file changed, 2 insertions(+), 12 deletions(-) 14 15diff --git a/xinclude.c b/xinclude.c 16index c0b4439..a9da439 100644 17--- a/xinclude.c 18+++ b/xinclude.c 19@@ -246,19 +246,9 @@ xmlXIncludeNewRef(xmlXIncludeCtxtPtr ctxt, const xmlChar *URI, 20 ret->count = 0; 21 ret->xml = 0; 22 ret->inc = NULL; 23- if (ctxt->incMax == 0) { 24- ctxt->incMax = 4; 25- ctxt->incTab = (xmlXIncludeRefPtr *) xmlMalloc(ctxt->incMax * 26- sizeof(ctxt->incTab[0])); 27- if (ctxt->incTab == NULL) { 28- xmlXIncludeErrMemory(ctxt, ref, "growing XInclude context"); 29- xmlXIncludeFreeRef(ret); 30- return(NULL); 31- } 32- } 33 if (ctxt->incNr >= ctxt->incMax) { 34 xmlXIncludeRefPtr *tmp; 35- size_t newSize = ctxt->incMax * 2; 36+ size_t newSize = ctxt->incMax ? ctxt->incMax * 2 : 4; 37 38 tmp = (xmlXIncludeRefPtr *) xmlRealloc(ctxt->incTab, 39 newSize * sizeof(ctxt->incTab[0])); 40@@ -268,7 +258,7 @@ xmlXIncludeNewRef(xmlXIncludeCtxtPtr ctxt, const xmlChar *URI, 41 return(NULL); 42 } 43 ctxt->incTab = tmp; 44- ctxt->incMax *= 2; 45+ ctxt->incMax = newSize; 46 } 47 ctxt->incTab[ctxt->incNr++] = ret; 48 return(ret); 49-- 502.27.0 51 52