1From 9afb6c5fb86a0dca167b6ae60aa05211a25e435f Mon Sep 17 00:00:00 2001 2From: Nick Wellnhofer <wellnhofer@aevum.de> 3Date: Sun, 5 Mar 2023 14:09:49 +0100 4Subject: [PATCH] malloc-fail: Fix memory leak in WXS_ADD_{LOCAL,GLOBAL} 5 6It's somewhat dangerous to add the cleanup code to a macro, but 7otherwise we'd have to fix all the call sites. 8 9Found with libFuzzer, see #344. 10 11Reference:https://github.com/GNOME/libxml2/commit/9afb6c5fb86a0dca167b6ae60aa05211a25e435f 12Conflict:NA 13--- 14 xmlschemas.c | 17 +++++++++++++---- 15 1 file changed, 13 insertions(+), 4 deletions(-) 16 17diff --git a/xmlschemas.c b/xmlschemas.c 18index 5b93937..724920b 100644 19--- a/xmlschemas.c 20+++ b/xmlschemas.c 21@@ -305,10 +305,20 @@ static const xmlChar *xmlNamespaceNs = (const xmlChar *) 22 #define WXS_SCHEMA(ctx) (ctx)->schema 23 24 #define WXS_ADD_LOCAL(ctx, item) \ 25- xmlSchemaAddItemSize(&(WXS_BUCKET(ctx)->locals), 10, item) 26+ do { \ 27+ if (xmlSchemaAddItemSize(&(WXS_BUCKET(ctx)->locals), 10, item) < 0) { \ 28+ xmlFree(item); \ 29+ item = NULL; \ 30+ } \ 31+ } while (0) 32 33 #define WXS_ADD_GLOBAL(ctx, item) \ 34- xmlSchemaAddItemSize(&(WXS_BUCKET(ctx)->globals), 5, item) 35+ do { \ 36+ if (xmlSchemaAddItemSize(&(WXS_BUCKET(ctx)->globals), 5, item) < 0) { \ 37+ xmlFree(item); \ 38+ item = NULL; \ 39+ } \ 40+ } while (0) 41 42 #define WXS_ADD_PENDING(ctx, item) \ 43 xmlSchemaAddItemSize(&((ctx)->constructor->pending), 10, item) 44@@ -3764,8 +3774,7 @@ xmlSchemaAddItemSize(xmlSchemaItemListPtr *list, int initialSize, void *item) 45 if (*list == NULL) 46 return(-1); 47 } 48- xmlSchemaItemListAddSize(*list, initialSize, item); 49- return(0); 50+ return(xmlSchemaItemListAddSize(*list, initialSize, item)); 51 } 52 53 /** 54-- 552.27.0 56 57