]> git.pld-linux.org Git - packages/libxml2.git/blob - libxml2-XPath.patch
- security patch: Invalid XPath Multiple Memory Corruption
[packages/libxml2.git] / libxml2-XPath.patch
1 diff --git a/xpath.c b/xpath.c
2 index 8b56189..608fe00 100644
3 --- a/xpath.c
4 +++ b/xpath.c
5 @@ -3522,13 +3522,13 @@ xmlXPathNodeSetAddNs(xmlNodeSetPtr cur, xmlNodePtr node, xmlNsPtr ns) {
6      } else if (cur->nodeNr == cur->nodeMax) {
7          xmlNodePtr *temp;
8  
9 -        cur->nodeMax *= 2;
10 -       temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax *
11 +       temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax * 2 *
12                                       sizeof(xmlNodePtr));
13         if (temp == NULL) {
14             xmlXPathErrMemory(NULL, "growing nodeset\n");
15             return;
16         }
17 +        cur->nodeMax *= 2;
18         cur->nodeTab = temp;
19      }
20      cur->nodeTab[cur->nodeNr++] = xmlXPathNodeSetDupNs(node, ns);
21 @@ -3627,14 +3627,14 @@ xmlXPathNodeSetAddUnique(xmlNodeSetPtr cur, xmlNodePtr val) {
22      } else if (cur->nodeNr == cur->nodeMax) {
23          xmlNodePtr *temp;
24  
25 -        cur->nodeMax *= 2;
26 -       temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax *
27 +       temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax * 2 *
28                                       sizeof(xmlNodePtr));
29         if (temp == NULL) {
30             xmlXPathErrMemory(NULL, "growing nodeset\n");
31             return;
32         }
33         cur->nodeTab = temp;
34 +        cur->nodeMax *= 2;
35      }
36      if (val->type == XML_NAMESPACE_DECL) {
37         xmlNsPtr ns = (xmlNsPtr) val;
38 @@ -3738,14 +3738,14 @@ xmlXPathNodeSetMerge(xmlNodeSetPtr val1, xmlNodeSetPtr val2) {
39         } else if (val1->nodeNr == val1->nodeMax) {
40             xmlNodePtr *temp;
41  
42 -           val1->nodeMax *= 2;
43 -           temp = (xmlNodePtr *) xmlRealloc(val1->nodeTab, val1->nodeMax *
44 +           temp = (xmlNodePtr *) xmlRealloc(val1->nodeTab, val1->nodeMax * 2 *
45                                              sizeof(xmlNodePtr));
46             if (temp == NULL) {
47                 xmlXPathErrMemory(NULL, "merging nodeset\n");
48                 return(NULL);
49             }
50             val1->nodeTab = temp;
51 +           val1->nodeMax *= 2;
52         }
53         if (n2->type == XML_NAMESPACE_DECL) {
54             xmlNsPtr ns = (xmlNsPtr) n2;
55 @@ -3907,14 +3907,14 @@ xmlXPathNodeSetMergeAndClear(xmlNodeSetPtr set1, xmlNodeSetPtr set2,
56             } else if (set1->nodeNr >= set1->nodeMax) {
57                 xmlNodePtr *temp;
58  
59 -               set1->nodeMax *= 2;
60                 temp = (xmlNodePtr *) xmlRealloc(
61 -                   set1->nodeTab, set1->nodeMax * sizeof(xmlNodePtr));
62 +                   set1->nodeTab, set1->nodeMax * 2 * sizeof(xmlNodePtr));
63                 if (temp == NULL) {
64                     xmlXPathErrMemory(NULL, "merging nodeset\n");
65                     return(NULL);
66                 }
67                 set1->nodeTab = temp;
68 +               set1->nodeMax *= 2;
69             }
70             if (n2->type == XML_NAMESPACE_DECL) {
71                 xmlNsPtr ns = (xmlNsPtr) n2;
72 @@ -3991,14 +3991,14 @@ xmlXPathNodeSetMergeAndClearNoDupls(xmlNodeSetPtr set1, xmlNodeSetPtr set2,
73             } else if (set1->nodeNr >= set1->nodeMax) {
74                 xmlNodePtr *temp;
75  
76 -               set1->nodeMax *= 2;
77                 temp = (xmlNodePtr *) xmlRealloc(
78 -                   set1->nodeTab, set1->nodeMax * sizeof(xmlNodePtr));
79 +                   set1->nodeTab, set1->nodeMax * 2 * sizeof(xmlNodePtr));
80                 if (temp == NULL) {
81                     xmlXPathErrMemory(NULL, "merging nodeset\n");
82                     return(NULL);
83                 }
84                 set1->nodeTab = temp;
85 +               set1->nodeMax *= 2;
86             }
87             set1->nodeTab[set1->nodeNr++] = n2;
88         }
This page took 0.075798 seconds and 3 git commands to generate.