1*ebc59d3fSDon LewisFrom 7ffcd44d7e6c46704f8af0321d9314cd26e0e18a Mon Sep 17 00:00:00 2001 2*ebc59d3fSDon LewisFrom: Zhipeng Xie <xiezhipeng1@huawei.com> 3*ebc59d3fSDon LewisDate: Tue, 20 Aug 2019 16:33:06 +0800 4*ebc59d3fSDon LewisSubject: [PATCH] Fix memory leak in xmlSchemaValidateStream 5*ebc59d3fSDon Lewis 6*ebc59d3fSDon LewisWhen ctxt->schema is NULL, xmlSchemaSAXPlug->xmlSchemaPreRun 7*ebc59d3fSDon Lewisalloc a new schema for ctxt->schema and set vctxt->xsiAssemble 8*ebc59d3fSDon Lewisto 1. Then xmlSchemaVStart->xmlSchemaPreRun initialize 9*ebc59d3fSDon Lewisvctxt->xsiAssemble to 0 again which cause the alloced schema 10*ebc59d3fSDon Lewiscan not be freed anymore. 11*ebc59d3fSDon Lewis 12*ebc59d3fSDon LewisFound with libFuzzer. 13*ebc59d3fSDon Lewis 14*ebc59d3fSDon LewisSigned-off-by: Zhipeng Xie <xiezhipeng1@huawei.com> 15*ebc59d3fSDon Lewis--- 16*ebc59d3fSDon Lewis xmlschemas.c | 1 - 17*ebc59d3fSDon Lewis 1 file changed, 1 deletion(-) 18*ebc59d3fSDon Lewis 19*ebc59d3fSDon Lewisdiff --git misc/libxml2-2.9.10/xmlschemas.c misc/build/libxml2-2.9.10/xmlschemas.c 20*ebc59d3fSDon Lewisindex 301c84499..39d92182f 100644 21*ebc59d3fSDon Lewis--- misc/libxml2-2.9.10/xmlschemas.c 22*ebc59d3fSDon Lewis+++ misc/build/libxml2-2.9.10/xmlschemas.c 23*ebc59d3fSDon Lewis@@ -28090,7 +28090,6 @@ xmlSchemaPreRun(xmlSchemaValidCtxtPtr vctxt) { 24*ebc59d3fSDon Lewis vctxt->nberrors = 0; 25*ebc59d3fSDon Lewis vctxt->depth = -1; 26*ebc59d3fSDon Lewis vctxt->skipDepth = -1; 27*ebc59d3fSDon Lewis- vctxt->xsiAssemble = 0; 28*ebc59d3fSDon Lewis vctxt->hasKeyrefs = 0; 29*ebc59d3fSDon Lewis #ifdef ENABLE_IDC_NODE_TABLES_TEST 30*ebc59d3fSDon Lewis vctxt->createIDCNodeTables = 1; 31*ebc59d3fSDon Lewis-- 32*ebc59d3fSDon LewisGitLab 33*ebc59d3fSDon Lewis 34