From 3cd2b25ddb04740be2880cfd78d60038452228b1 Mon Sep 17 00:00:00 2001 From: Zhipeng Xie Date: Wed, 7 Aug 2019 17:39:17 +0800 Subject: [PATCH] Fix memory leak in xmlParseBalancedChunkMemoryRecover When doc is NULL, namespace created in xmlTreeEnsureXMLDecl is bind to newDoc->oldNs, in this case, set newDoc->oldNs to NULL and free newDoc will cause a memory leak. Found with libFuzzer. Closes #82. Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/commit/5a02583c7e683896d84878bd90641d8d9b0d0549] CVE: CVE-2019-19956 Signed-off-by: Rahul Chauhan --- parser.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/parser.c b/parser.c index b7ecd65..491f5c9 100644 --- a/parser.c +++ b/parser.c @@ -13899,7 +13899,8 @@ xmlParseBalancedChunkMemoryRecover(xmlDocPtr doc, xmlSAXHandlerPtr sax, xmlFreeParserCtxt(ctxt); newDoc->intSubset = NULL; newDoc->extSubset = NULL; - newDoc->oldNs = NULL; + if(doc != NULL) + newDoc->oldNs = NULL; xmlFreeDoc(newDoc); return(ret); -- 2.7.4