1From 0263b357567870c20de26c90dbc962aec81c5a19 Mon Sep 17 00:00:00 2001 2From: Nick Wellnhofer <wellnhofer@aevum.de> 3Date: Sun, 5 Mar 2023 14:08:35 +0100 4Subject: [PATCH] malloc-fail: Fix null deref in xmlGet{Min,Max}Occurs 5 6Also report memory error in xmlSchemaGetNodeContent. 7 8Found with libFuzzer, see #344. 9 10Reference:https://github.com/GNOME/libxml2/commit/0263b357567870c20de26c90dbc962aec81c5a19 11Conflict:NA 12--- 13 xmlschemas.c | 6 ++++++ 14 1 file changed, 6 insertions(+) 15 16diff --git a/xmlschemas.c b/xmlschemas.c 17index 9be7999..c68103c 100644 18--- a/xmlschemas.c 19+++ b/xmlschemas.c 20@@ -4760,6 +4760,8 @@ xmlSchemaGetNodeContent(xmlSchemaParserCtxtPtr ctxt, xmlNodePtr node) 21 val = xmlStrdup((xmlChar *)""); 22 ret = xmlDictLookup(ctxt->dict, val, -1); 23 xmlFree(val); 24+ if (ret == NULL) 25+ xmlSchemaPErrMemory(ctxt, "getting node content", node); 26 return(ret); 27 } 28 29@@ -6103,6 +6105,8 @@ xmlGetMaxOccurs(xmlSchemaParserCtxtPtr ctxt, xmlNodePtr node, 30 if (attr == NULL) 31 return (def); 32 val = xmlSchemaGetNodeContent(ctxt, (xmlNodePtr) attr); 33+ if (val == NULL) 34+ return (def); 35 36 if (xmlStrEqual(val, (const xmlChar *) "unbounded")) { 37 if (max != UNBOUNDED) { 38@@ -6177,6 +6181,8 @@ xmlGetMinOccurs(xmlSchemaParserCtxtPtr ctxt, xmlNodePtr node, 39 if (attr == NULL) 40 return (def); 41 val = xmlSchemaGetNodeContent(ctxt, (xmlNodePtr) attr); 42+ if (val == NULL) 43+ return (def); 44 cur = val; 45 while (IS_BLANK_CH(*cur)) 46 cur++; 47-- 482.27.0 49 50