[libxml2] Fix memory leak in xmlBufAttrSerializeTxtContent



commit 362b32293487ece0dc76b9df29c59e25c0712432
Author: Nick Wellnhofer <wellnhofer aevum de>
Date:   Wed Jun 7 16:35:28 2017 +0200

    Fix memory leak in xmlBufAttrSerializeTxtContent
    
    The serializer sets doc->encoding to a temporary value and restores
    the original value when it's done. This overwrites the encoding value
    set in xmlBufAttrSerializeTxtContent, causing a memory leak.
    
    Don't mess with doc->encoding if invalid UTF-8 is encountered.
    
    Found with libFuzzer and ASan.

 xmlsave.c |    5 -----
 1 files changed, 0 insertions(+), 5 deletions(-)
---
diff --git a/xmlsave.c b/xmlsave.c
index 4a8e3f3..fea135f 100644
--- a/xmlsave.c
+++ b/xmlsave.c
@@ -2109,8 +2109,6 @@ xmlBufAttrSerializeTxtContent(xmlBufPtr buf, xmlDocPtr doc,
                 xmlBufAdd(buf, base, cur - base);
             if (*cur < 0xC0) {
                 xmlSaveErr(XML_SAVE_NOT_UTF8, (xmlNodePtr) attr, NULL);
-                if (doc != NULL)
-                    doc->encoding = xmlStrdup(BAD_CAST "ISO-8859-1");
                xmlSerializeHexCharRef(tmp, *cur);
                 xmlBufAdd(buf, (xmlChar *) tmp, -1);
                 cur++;
@@ -2140,9 +2138,6 @@ xmlBufAttrSerializeTxtContent(xmlBufPtr buf, xmlDocPtr doc,
             }
             if ((l == 1) || (!IS_CHAR(val))) {
                 xmlSaveErr(XML_SAVE_CHAR_INVALID, (xmlNodePtr) attr, NULL);
-                if (doc != NULL)
-                    doc->encoding = xmlStrdup(BAD_CAST "ISO-8859-1");
-
                xmlSerializeHexCharRef(tmp, *cur);
                 xmlBufAdd(buf, (xmlChar *) tmp, -1);
                 cur++;


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]