1From 6fd8904108f23810699d3a242e3612c4ec2f9cf2 Mon Sep 17 00:00:00 2001 2From: Nick Wellnhofer <wellnhofer@aevum.de> 3Date: Sun, 22 Jan 2023 19:42:41 +0100 4Subject: [PATCH] malloc-fail: Fix use-after-free in xmlParseStartTag2 5 6Fix error handling in xmlCtxtGrowAttrs. 7 8Found with libFuzzer, see #344. 9 10Reference:https://github.com/GNOME/libxml2/commit/6fd8904108f23810699d3a242e3612c4ec2f9cf2 11Conflict:NA 12--- 13 parser.c | 26 +++++++++++--------------- 14 1 file changed, 11 insertions(+), 15 deletions(-) 15 16diff --git a/parser.c b/parser.c 17index 88f04e4..3aea3e2 100644 18--- a/parser.c 19+++ b/parser.c 20@@ -1715,25 +1715,21 @@ xmlCtxtGrowAttrs(xmlParserCtxtPtr ctxt, int nr) { 21 int *attallocs; 22 int maxatts; 23 24- if (ctxt->atts == NULL) { 25- maxatts = 55; /* allow for 10 attrs by default */ 26- atts = (const xmlChar **) 27- xmlMalloc(maxatts * sizeof(xmlChar *)); 28- if (atts == NULL) goto mem_error; 29- ctxt->atts = atts; 30- attallocs = (int *) xmlMalloc((maxatts / 5) * sizeof(int)); 31- if (attallocs == NULL) goto mem_error; 32- ctxt->attallocs = attallocs; 33- ctxt->maxatts = maxatts; 34- } else if (nr + 5 > ctxt->maxatts) { 35- maxatts = (nr + 5) * 2; 36- atts = (const xmlChar **) xmlRealloc((void *) ctxt->atts, 37+ if (nr + 5 > ctxt->maxatts) { 38+ maxatts = ctxt->maxatts == 0 ? 55 : (nr + 5) * 2; 39+ atts = (const xmlChar **) xmlMalloc( 40 maxatts * sizeof(const xmlChar *)); 41 if (atts == NULL) goto mem_error; 42- ctxt->atts = atts; 43 attallocs = (int *) xmlRealloc((void *) ctxt->attallocs, 44 (maxatts / 5) * sizeof(int)); 45- if (attallocs == NULL) goto mem_error; 46+ if (attallocs == NULL) { 47+ xmlFree(atts); 48+ goto mem_error; 49+ } 50+ if (ctxt->maxatts > 0) 51+ memcpy(atts, ctxt->atts, ctxt->maxatts * sizeof(const xmlChar *)); 52+ xmlFree(ctxt->atts); 53+ ctxt->atts = atts; 54 ctxt->attallocs = attallocs; 55 ctxt->maxatts = maxatts; 56 } 57-- 582.27.0 59 60