1*b1cdbd2cSJim JagielskiFrom 7ffcd44d7e6c46704f8af0321d9314cd26e0e18a Mon Sep 17 00:00:00 2001
2*b1cdbd2cSJim JagielskiFrom: Zhipeng Xie <xiezhipeng1@huawei.com>
3*b1cdbd2cSJim JagielskiDate: Tue, 20 Aug 2019 16:33:06 +0800
4*b1cdbd2cSJim JagielskiSubject: [PATCH] Fix memory leak in xmlSchemaValidateStream
5*b1cdbd2cSJim Jagielski
6*b1cdbd2cSJim JagielskiWhen ctxt->schema is NULL, xmlSchemaSAXPlug->xmlSchemaPreRun
7*b1cdbd2cSJim Jagielskialloc a new schema for ctxt->schema and set vctxt->xsiAssemble
8*b1cdbd2cSJim Jagielskito 1. Then xmlSchemaVStart->xmlSchemaPreRun initialize
9*b1cdbd2cSJim Jagielskivctxt->xsiAssemble to 0 again which cause the alloced schema
10*b1cdbd2cSJim Jagielskican not be freed anymore.
11*b1cdbd2cSJim Jagielski
12*b1cdbd2cSJim JagielskiFound with libFuzzer.
13*b1cdbd2cSJim Jagielski
14*b1cdbd2cSJim JagielskiSigned-off-by: Zhipeng Xie <xiezhipeng1@huawei.com>
15*b1cdbd2cSJim Jagielski---
16*b1cdbd2cSJim Jagielski xmlschemas.c | 1 -
17*b1cdbd2cSJim Jagielski 1 file changed, 1 deletion(-)
18*b1cdbd2cSJim Jagielski
19*b1cdbd2cSJim Jagielskidiff --git misc/libxml2-2.9.10/xmlschemas.c misc/build/libxml2-2.9.10/xmlschemas.c
20*b1cdbd2cSJim Jagielskiindex 301c84499..39d92182f 100644
21*b1cdbd2cSJim Jagielski--- misc/libxml2-2.9.10/xmlschemas.c
22*b1cdbd2cSJim Jagielski+++ misc/build/libxml2-2.9.10/xmlschemas.c
23*b1cdbd2cSJim Jagielski@@ -28090,7 +28090,6 @@ xmlSchemaPreRun(xmlSchemaValidCtxtPtr vctxt) {
24*b1cdbd2cSJim Jagielski     vctxt->nberrors = 0;
25*b1cdbd2cSJim Jagielski     vctxt->depth = -1;
26*b1cdbd2cSJim Jagielski     vctxt->skipDepth = -1;
27*b1cdbd2cSJim Jagielski-    vctxt->xsiAssemble = 0;
28*b1cdbd2cSJim Jagielski     vctxt->hasKeyrefs = 0;
29*b1cdbd2cSJim Jagielski #ifdef ENABLE_IDC_NODE_TABLES_TEST
30*b1cdbd2cSJim Jagielski     vctxt->createIDCNodeTables = 1;
31*b1cdbd2cSJim Jagielski--
32*b1cdbd2cSJim JagielskiGitLab
33*b1cdbd2cSJim Jagielski
34