From 89632441fba22400cc5b1e413766aa2f32ff5f91 Mon Sep 17 00:00:00 2001
From: Jay Civelli <jcivelli google com>
Date: Mon, 8 Jan 2018 13:38:39 -0800
Subject: [PATCH] Fix heap use after free.

In parser.c, if a call to xmlCharEncInput() fails and has grown
the buffer, the ctxt object could still point to the old deleted
buffer.
Halt the parsing in such a case.
---
 parser.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/parser.c b/parser.c
index a30dd18e..823793c4 100644
--- a/parser.c
+++ b/parser.c
@@ -12214,9 +12214,9 @@ xmldecl_done:
 		nbchars = xmlCharEncInput(in, terminate);
 		if (nbchars < 0) {
 		    /* TODO 2.6.0 */
-		    xmlGenericError(xmlGenericErrorContext,
-				    "xmlParseChunk: encoder error\n");
-		    return(XML_ERR_INVALID_ENCODING);
+            ctxt->errNo = XML_ERR_INVALID_CHAR;
+            xmlHaltParser(ctxt);
+            return (XML_ERR_INVALID_CHAR);
 		}
 		xmlBufSetInputBaseCur(in->buffer, ctxt->input, base, current);
 	    }
-- 
2.16.0.rc0.223.g4a4ac83678-goog