[libxslt] Fix dangling pointer in xsltCopyText



commit 2232473733b7313d67de8836ea3b29eec6e8e285
Author: Nick Wellnhofer <wellnhofer aevum de>
Date:   Sat Aug 17 16:51:53 2019 +0200

    Fix dangling pointer in xsltCopyText
    
    xsltCopyText didn't reset ctxt->lasttext in some cases which could
    lead to various memory errors in relation with CDATA sections in input
    documents.
    
    Found by OSS-Fuzz.

 libxslt/transform.c | 2 ++
 1 file changed, 2 insertions(+)
---
diff --git a/libxslt/transform.c b/libxslt/transform.c
index 95ebd073..d7ab0b66 100644
--- a/libxslt/transform.c
+++ b/libxslt/transform.c
@@ -1094,6 +1094,8 @@ xsltCopyText(xsltTransformContextPtr ctxt, xmlNodePtr target,
            if ((copy->content = xmlStrdup(cur->content)) == NULL)
                return NULL;
        }
+
+       ctxt->lasttext = NULL;
     } else {
         /*
         * normal processing. keep counters to extend the text node


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]