1*2a621114SDon LewisFrom 7ffcd44d7e6c46704f8af0321d9314cd26e0e18a Mon Sep 17 00:00:00 2001 2*2a621114SDon LewisFrom: Zhipeng Xie <xiezhipeng1@huawei.com> 3*2a621114SDon LewisDate: Tue, 20 Aug 2019 16:33:06 +0800 4*2a621114SDon LewisSubject: [PATCH] Fix memory leak in xmlSchemaValidateStream 5*2a621114SDon Lewis 6*2a621114SDon LewisWhen ctxt->schema is NULL, xmlSchemaSAXPlug->xmlSchemaPreRun 7*2a621114SDon Lewisalloc a new schema for ctxt->schema and set vctxt->xsiAssemble 8*2a621114SDon Lewisto 1. Then xmlSchemaVStart->xmlSchemaPreRun initialize 9*2a621114SDon Lewisvctxt->xsiAssemble to 0 again which cause the alloced schema 10*2a621114SDon Lewiscan not be freed anymore. 11*2a621114SDon Lewis 12*2a621114SDon LewisFound with libFuzzer. 13*2a621114SDon Lewis 14*2a621114SDon LewisSigned-off-by: Zhipeng Xie <xiezhipeng1@huawei.com> 15*2a621114SDon Lewis--- 16*2a621114SDon Lewis xmlschemas.c | 1 - 17*2a621114SDon Lewis 1 file changed, 1 deletion(-) 18*2a621114SDon Lewis 19*2a621114SDon Lewisdiff --git misc/libxml2-2.9.10/xmlschemas.c misc/build/libxml2-2.9.10/xmlschemas.c 20*2a621114SDon Lewisindex 301c84499..39d92182f 100644 21*2a621114SDon Lewis--- misc/libxml2-2.9.10/xmlschemas.c 22*2a621114SDon Lewis+++ misc/build/libxml2-2.9.10/xmlschemas.c 23*2a621114SDon Lewis@@ -28090,7 +28090,6 @@ xmlSchemaPreRun(xmlSchemaValidCtxtPtr vctxt) { 24*2a621114SDon Lewis vctxt->nberrors = 0; 25*2a621114SDon Lewis vctxt->depth = -1; 26*2a621114SDon Lewis vctxt->skipDepth = -1; 27*2a621114SDon Lewis- vctxt->xsiAssemble = 0; 28*2a621114SDon Lewis vctxt->hasKeyrefs = 0; 29*2a621114SDon Lewis #ifdef ENABLE_IDC_NODE_TABLES_TEST 30*2a621114SDon Lewis vctxt->createIDCNodeTables = 1; 31*2a621114SDon Lewis-- 32*2a621114SDon LewisGitLab 33*2a621114SDon Lewis 34