30 lines
889 B
Diff
30 lines
889 B
Diff
|
From 0cbeb50ee03ce582a0c979c70d8fbf030e270c37 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Daniel Veillard <veillard@redhat.com>
|
||
|
|
Date: Mon, 15 Nov 2010 11:06:29 +0000
|
||
|
|
Subject: Fix a potential memory access error
|
||
|
|
|
||
|
|
in case of a previus allocation error
|
||
|
|
---
|
||
|
|
diff --git a/xpath.c b/xpath.c
|
||
|
|
index 4d6826d..81e33f6 100644
|
||
|
|
--- a/xpath.c
|
||
|
|
+++ b/xpath.c
|
||
|
|
@@ -3575,13 +3575,13 @@ xmlXPathNodeSetAdd(xmlNodeSetPtr cur, xmlNodePtr val) {
|
||
|
|
} else if (cur->nodeNr == cur->nodeMax) {
|
||
|
|
xmlNodePtr *temp;
|
||
|
|
|
||
|
|
- cur->nodeMax *= 2;
|
||
|
|
- temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax *
|
||
|
|
+ temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax * 2 *
|
||
|
|
sizeof(xmlNodePtr));
|
||
|
|
if (temp == NULL) {
|
||
|
|
xmlXPathErrMemory(NULL, "growing nodeset\n");
|
||
|
|
return;
|
||
|
|
}
|
||
|
|
+ cur->nodeMax *= 2;
|
||
|
|
cur->nodeTab = temp;
|
||
|
|
}
|
||
|
|
if (val->type == XML_NAMESPACE_DECL) {
|
||
|
|
--
|
||
|
|
cgit v0.8.3.1
|