[CVE-2019-19956] Fix memory leak in xmlParseBalancedChunkMemoryRecover

When doc is NULL, namespace created in xmlTreeEnsureXMLDecl
is bind to newDoc->oldNs, in this case, set newDoc->oldNs to
NULL and free newDoc will cause a memory leak.

Found with libFuzzer.

Closes #82.

Change-Id: I9de145cc666e3791a81bfacb3930d21e624c4a7a
Signed-off-by: DongHun Kwak <dh0128.kwak@samsung.com>

diff --git a/parser.c b/parser.c
index 5813a66..7b532e0 100644 (file)
--- a/parser.c
+++ b/parser.c
@@ -13898,7 +13898,8 @@ xmlParseBalancedChunkMemoryRecover(xmlDocPtr doc, xmlSAXHandlerPtr sax,
     xmlFreeParserCtxt(ctxt);
     newDoc->intSubset = NULL;
     newDoc->extSubset = NULL;
-    newDoc->oldNs = NULL;
+    if(doc != NULL)
+        newDoc->oldNs = NULL;
     xmlFreeDoc(newDoc);
 
     return(ret);