commit 09b6f8183d05719830de80334dea83edeeec44e6
author Nick Wellnhofer <wellnhofer@aevum.de> Sun Aug 25 13:58:41 2019 +0200
committer Nick Wellnhofer <wellnhofer@aevum.de> Sun Aug 25 14:12:34 2019 +0200
tree 2f79ccde638d4c59a71960a8d28b21314aa69151
parent 01d8cf07d9136aa2ecb1e4925a239973cbc89285

Fix potential null deref in xmlRelaxNGParsePatterns

Thanks to Zhongyuan Zhou for the initial patch.

relaxng.c

diff --git a/relaxng.c b/relaxng.c
index 268c4e7..53125c8 100644
--- a/relaxng.c
+++ b/relaxng.c
@@ -5548,12 +5548,16 @@
     while (nodes != NULL) {
         if (IS_RELAXNG(nodes, "element")) {
             cur = xmlRelaxNGParseElement(ctxt, nodes);
+            if (cur == NULL)
+                return (NULL);
             if (def == NULL) {
                 def = last = cur;
             } else {
                 if ((group == 1) && (def->type == XML_RELAXNG_ELEMENT) &&
                     (def == last)) {
                     def = xmlRelaxNGNewDefine(ctxt, nodes);
+                    if (def == NULL)
+                        return (NULL);
                     def->type = XML_RELAXNG_GROUP;
                     def->content = last;
                 }