[libxml2] Fix double free in XML reader with XIncludes



commit ba589adc2f86c6be9ad7e0d771d4c9b09d059b89
Author: Nick Wellnhofer <wellnhofer aevum de>
Date:   Tue Aug 25 23:50:39 2020 +0200

    Fix double free in XML reader with XIncludes
    
    An XInclude with empty fallback could lead to a double free in
    xmlTextReaderRead.
    
    Found by OSS-Fuzz.

 xmlreader.c | 2 ++
 1 file changed, 2 insertions(+)
---
diff --git a/xmlreader.c b/xmlreader.c
index 6ae6e9229..1ab15ba7a 100644
--- a/xmlreader.c
+++ b/xmlreader.c
@@ -1491,6 +1491,8 @@ get_next_node:
             (reader->node->prev->type != XML_DTD_NODE)) {
            xmlNodePtr tmp = reader->node->prev;
            if ((tmp->extra & NODE_IS_PRESERVED) == 0) {
+                if (oldnode == tmp)
+                    oldnode = NULL;
                xmlUnlinkNode(tmp);
                xmlTextReaderFreeNode(reader, tmp);
            }


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]