[CVE-2024-56171] Fix use-after-free after xmlSchemaItemListAdd xmlSchemaItemListAdd can reallocate the items array. Update local variables after adding item in - xmlSchemaIDCFillNodeTables - xmlSchemaBubbleIDCNodeTables Fixes #828.
diff --git a/xmlschemas.c b/xmlschemas.c index 1b3c524..95be97c 100644 --- a/xmlschemas.c +++ b/xmlschemas.c
@@ -23374,6 +23374,7 @@ } if (xmlSchemaItemListAdd(bind->dupls, bind->nodeTable[j]) == -1) goto internal_error; + dupls = (xmlSchemaPSVIIDCNodePtr *) bind->dupls->items; /* * Remove the duplicate entry from the IDC node-table. */ @@ -23590,6 +23591,8 @@ goto internal_error; } xmlSchemaItemListAdd(parBind->dupls, parNode); + dupls = (xmlSchemaPSVIIDCNodePtr *) + parBind->dupls->items; } else { /* * Add the node-table entry (node and key-sequence) of