commit fbb7fa9a9ad8269834d32ff872b1477ff7b9c705
author Nick Wellnhofer <wellnhofer@aevum.de> Wed Aug 19 13:13:20 2020 +0200
committer Nick Wellnhofer <wellnhofer@aevum.de> Wed Aug 19 13:13:48 2020 +0200
tree 4f07f6c523a21a00461fd7dd03dc7abedce62e3b
parent 19cae17f5a2acfbd5554d145bb87cd6bf2de244f

Fix memory leak in xmlXIncludeAddNode error paths

Found by OSS-Fuzz.

xinclude.c

diff --git a/xinclude.c b/xinclude.c
index 9024535..aac30d5 100644
--- a/xinclude.c
+++ b/xinclude.c
@@ -627,8 +627,8 @@
 	xmlXIncludeErr(ctxt, cur, XML_XINCLUDE_RECURSION,
 	               "detected a local recursion with no xpointer in %s\n",
 		       URL);
-	if (fragment != NULL)
-	    xmlFree(fragment);
+        xmlFree(URL);
+        xmlFree(fragment);
 	return(-1);
     }
 
@@ -640,12 +640,15 @@
 	    if (xmlStrEqual(URL, ctxt->urlTab[i])) {
 		xmlXIncludeErr(ctxt, cur, XML_XINCLUDE_RECURSION,
 		               "detected a recursion in %s\n", URL);
+                xmlFree(URL);
+                xmlFree(fragment);
 		return(-1);
 	    }
 	}
     }
 
     ref = xmlXIncludeNewRef(ctxt, URL, cur);
+    xmlFree(URL);
     if (ref == NULL) {
 	return(-1);
     }
@@ -653,7 +656,6 @@
     ref->doc = NULL;
     ref->xml = xml;
     ref->count = 1;
-    xmlFree(URL);
     return(0);
 }