1From 5880a9a6bd97c0f9ac8fc4f30110fe023f484746 Mon Sep 17 00:00:00 2001 2From: Nick Wellnhofer <wellnhofer@aevum.de> 3Date: Tue, 10 Dec 2024 16:52:05 +0100 4Subject: [PATCH] [CVE-2024-56171] Fix use-after-free after 5 xmlSchemaItemListAdd 6 7xmlSchemaItemListAdd can reallocate the items array. Update local 8variables after adding item in 9 10- xmlSchemaIDCFillNodeTables 11- xmlSchemaBubbleIDCNodeTables 12 13Fixes #828. 14--- 15 xmlschemas.c | 3 +++ 16 1 file changed, 3 insertions(+) 17 18diff --git a/xmlschemas.c b/xmlschemas.c 19index 1b3c524f2..95be97c96 100644 20--- a/xmlschemas.c 21+++ b/xmlschemas.c 22@@ -23374,6 +23374,7 @@ xmlSchemaIDCFillNodeTables(xmlSchemaValidCtxtPtr vctxt, 23 } 24 if (xmlSchemaItemListAdd(bind->dupls, bind->nodeTable[j]) == -1) 25 goto internal_error; 26+ dupls = (xmlSchemaPSVIIDCNodePtr *) bind->dupls->items; 27 /* 28 * Remove the duplicate entry from the IDC node-table. 29 */ 30@@ -23590,6 +23591,8 @@ xmlSchemaBubbleIDCNodeTables(xmlSchemaValidCtxtPtr vctxt) 31 goto internal_error; 32 } 33 xmlSchemaItemListAdd(parBind->dupls, parNode); 34+ dupls = (xmlSchemaPSVIIDCNodePtr *) 35+ parBind->dupls->items; 36 } else { 37 /* 38 * Add the node-table entry (node and key-sequence) of 39-- 40GitLab 41 42