commit 5a02583c7e683896d84878bd90641d8d9b0d0549
author Zhipeng Xie <xiezhipeng1@huawei.com> Wed Aug 07 17:39:17 2019 +0800
committer Nick Wellnhofer <wellnhofer@aevum.de> Mon Aug 26 11:20:49 2019 +0200
tree e84282a038273382e13262277f12ecfcd02f4229
parent 09b6f8183d05719830de80334dea83edeeec44e6

Fix memory leak in xmlParseBalancedChunkMemoryRecover

When doc is NULL, namespace created in xmlTreeEnsureXMLDecl
is bind to newDoc->oldNs, in this case, set newDoc->oldNs to
NULL and free newDoc will cause a memory leak.

Found with libFuzzer.

Closes #82.

parser.c

diff --git a/parser.c b/parser.c
index 1ce1ccf..26d9f4e 100644
--- a/parser.c
+++ b/parser.c
@@ -13894,7 +13894,8 @@
     xmlFreeParserCtxt(ctxt);
     newDoc->intSubset = NULL;
     newDoc->extSubset = NULL;
-    newDoc->oldNs = NULL;
+    if(doc != NULL)
+	newDoc->oldNs = NULL;
     xmlFreeDoc(newDoc);
 
     return(ret);