7f68c3aec0
CVS-2009-2414 CVS-2009-2416 CVS-2011-1944 Discussion with:bapt Approved by: secteam (myself) Obtained from: fedora/gentoo Security: http://www.vuxml.org/freebsd/ce4b3af8-0b7c-11e1-846b-00235409fd3e.html http://www.vuxml.org/freebsd/ce4b3af8-0b7c-11e1-846b-00235409fd3e.html http://www.vuxml.org/freebsd/5a7d4110-0b7a-11e1-846b-00235409fd3e.html Feature safe: yes
36 lines
1.3 KiB
Diff
36 lines
1.3 KiB
Diff
--- xpath.c.orig 2000-06-28 19:33:51.000000000 +0100
|
|
+++ xpath.c 2011-06-02 16:20:16.095097371 +0100
|
|
@@ -179,13 +179,13 @@
|
|
#define PUSH_AND_POP(type, name) \
|
|
extern int name##Push(xmlXPathParserContextPtr ctxt, type value) { \
|
|
if (ctxt->name##Nr >= ctxt->name##Max) { \
|
|
- ctxt->name##Max *= 2; \
|
|
ctxt->name##Tab = (void *) xmlRealloc(ctxt->name##Tab, \
|
|
- ctxt->name##Max * sizeof(ctxt->name##Tab[0])); \
|
|
+ ctxt->name##Max * 2 * sizeof(ctxt->name##Tab[0])); \
|
|
if (ctxt->name##Tab == NULL) { \
|
|
fprintf(xmlXPathDebug, "realloc failed !\n"); \
|
|
return(0); \
|
|
} \
|
|
+ ctxt->name##Max *= 2; \
|
|
} \
|
|
ctxt->name##Tab[ctxt->name##Nr] = value; \
|
|
ctxt->name = value; \
|
|
@@ -418,14 +418,14 @@
|
|
} else if (cur->nodeNr == cur->nodeMax) {
|
|
xmlNodePtr *temp;
|
|
|
|
- cur->nodeMax *= 2;
|
|
- temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax *
|
|
+ temp = (xmlNodePtr *) xmlRealloc(cur->nodeTab, cur->nodeMax * 2 *
|
|
sizeof(xmlNodePtr));
|
|
if (temp == NULL) {
|
|
fprintf(xmlXPathDebug, "xmlXPathNodeSetAdd: out of memory\n");
|
|
return;
|
|
}
|
|
cur->nodeTab = temp;
|
|
+ cur->nodeMax *= 2;
|
|
}
|
|
cur->nodeTab[cur->nodeNr++] = val;
|
|
}
|
|
|