]> git.pld-linux.org Git - packages/libxml2.git/blame - libxml2-XPath.patch
- security patch: Invalid XPath Multiple Memory Corruption
[packages/libxml2.git] / libxml2-XPath.patch
CommitLineData
10b29e32 1diff --git a/xpath.c b/xpath.c
2index 8b56189..608fe00 100644
3--- a/xpath.c
4+++ b/xpath.c
5@@ -3522,13 +3522,13 @@ xmlXPathNodeSetAddNs(xmlNodeSetPtr cur, xmlNodePtr node, xmlNsPtr ns) {
6 } else if (cur->nodeNr == cur->nodeMax) {
7 xmlNodePtr *temp;
8
9- cur->nodeMax *= 2;
10- temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax *
11+ temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax * 2 *
12 sizeof(xmlNodePtr));
13 if (temp == NULL) {
14 xmlXPathErrMemory(NULL, "growing nodeset\n");
15 return;
16 }
17+ cur->nodeMax *= 2;
18 cur->nodeTab = temp;
19 }
20 cur->nodeTab[cur->nodeNr++] = xmlXPathNodeSetDupNs(node, ns);
21@@ -3627,14 +3627,14 @@ xmlXPathNodeSetAddUnique(xmlNodeSetPtr cur, xmlNodePtr val) {
22 } else if (cur->nodeNr == cur->nodeMax) {
23 xmlNodePtr *temp;
24
25- cur->nodeMax *= 2;
26- temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax *
27+ temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax * 2 *
28 sizeof(xmlNodePtr));
29 if (temp == NULL) {
30 xmlXPathErrMemory(NULL, "growing nodeset\n");
31 return;
32 }
33 cur->nodeTab = temp;
34+ cur->nodeMax *= 2;
35 }
36 if (val->type == XML_NAMESPACE_DECL) {
37 xmlNsPtr ns = (xmlNsPtr) val;
38@@ -3738,14 +3738,14 @@ xmlXPathNodeSetMerge(xmlNodeSetPtr val1, xmlNodeSetPtr val2) {
39 } else if (val1->nodeNr == val1->nodeMax) {
40 xmlNodePtr *temp;
41
42- val1->nodeMax *= 2;
43- temp = (xmlNodePtr *) xmlRealloc(val1->nodeTab, val1->nodeMax *
44+ temp = (xmlNodePtr *) xmlRealloc(val1->nodeTab, val1->nodeMax * 2 *
45 sizeof(xmlNodePtr));
46 if (temp == NULL) {
47 xmlXPathErrMemory(NULL, "merging nodeset\n");
48 return(NULL);
49 }
50 val1->nodeTab = temp;
51+ val1->nodeMax *= 2;
52 }
53 if (n2->type == XML_NAMESPACE_DECL) {
54 xmlNsPtr ns = (xmlNsPtr) n2;
55@@ -3907,14 +3907,14 @@ xmlXPathNodeSetMergeAndClear(xmlNodeSetPtr set1, xmlNodeSetPtr set2,
56 } else if (set1->nodeNr >= set1->nodeMax) {
57 xmlNodePtr *temp;
58
59- set1->nodeMax *= 2;
60 temp = (xmlNodePtr *) xmlRealloc(
61- set1->nodeTab, set1->nodeMax * sizeof(xmlNodePtr));
62+ set1->nodeTab, set1->nodeMax * 2 * sizeof(xmlNodePtr));
63 if (temp == NULL) {
64 xmlXPathErrMemory(NULL, "merging nodeset\n");
65 return(NULL);
66 }
67 set1->nodeTab = temp;
68+ set1->nodeMax *= 2;
69 }
70 if (n2->type == XML_NAMESPACE_DECL) {
71 xmlNsPtr ns = (xmlNsPtr) n2;
72@@ -3991,14 +3991,14 @@ xmlXPathNodeSetMergeAndClearNoDupls(xmlNodeSetPtr set1, xmlNodeSetPtr set2,
73 } else if (set1->nodeNr >= set1->nodeMax) {
74 xmlNodePtr *temp;
75
76- set1->nodeMax *= 2;
77 temp = (xmlNodePtr *) xmlRealloc(
78- set1->nodeTab, set1->nodeMax * sizeof(xmlNodePtr));
79+ set1->nodeTab, set1->nodeMax * 2 * sizeof(xmlNodePtr));
80 if (temp == NULL) {
81 xmlXPathErrMemory(NULL, "merging nodeset\n");
82 return(NULL);
83 }
84 set1->nodeTab = temp;
85+ set1->nodeMax *= 2;
86 }
87 set1->nodeTab[set1->nodeNr++] = n2;
88 }
This page took 0.060655 seconds and 4 git commands to generate.