10126.diff

commit 8c9daf790abfc06e8ca3a44652542c577bb67d49
Author: Nick Wellnhofer <wellnhofer@aevum.de>
Date:   Wed Sep 12 13:42:27 2018 +0200

    Check return value of nodePush in xmlSAX2StartElement
    
    If the maximum depth is exceeded, nodePush halts the parser which
    results in freeing the input buffer since the previous commit. This
    invalidates the attribute pointers, so the error condition must be
    checked.
    
    Found by OSS-Fuzz.

diff --git a/SAX2.c b/SAX2.c
index 0f261b7b..49ce566c 100644
--- a/SAX2.c
+++ b/SAX2.c
@@ -1592,206 +1592,209 @@ void
 xmlSAX2StartElement(void *ctx, const xmlChar *fullname, const xmlChar **atts)
 {
     xmlParserCtxtPtr ctxt = (xmlParserCtxtPtr) ctx;
     xmlNodePtr ret;
     xmlNodePtr parent;
     xmlNsPtr ns;
     xmlChar *name;
     xmlChar *prefix;
     const xmlChar *att;
     const xmlChar *value;
     int i;
 
     if ((ctx == NULL) || (fullname == NULL) || (ctxt->myDoc == NULL)) return;
     parent = ctxt->node;
 #ifdef DEBUG_SAX
     xmlGenericError(xmlGenericErrorContext,
 	    "SAX.xmlSAX2StartElement(%s)\n", fullname);
 #endif
 
     /*
      * First check on validity:
      */
     if (ctxt->validate && (ctxt->myDoc->extSubset == NULL) &&
         ((ctxt->myDoc->intSubset == NULL) ||
 	 ((ctxt->myDoc->intSubset->notations == NULL) &&
 	  (ctxt->myDoc->intSubset->elements == NULL) &&
 	  (ctxt->myDoc->intSubset->attributes == NULL) &&
 	  (ctxt->myDoc->intSubset->entities == NULL)))) {
 	xmlErrValid(ctxt, XML_ERR_NO_DTD,
 	  "Validation failed: no DTD found !", NULL, NULL);
 	ctxt->validate = 0;
     }
 
 
     /*
      * Split the full name into a namespace prefix and the tag name
      */
     name = xmlSplitQName(ctxt, fullname, &prefix);
 
 
     /*
      * Note : the namespace resolution is deferred until the end of the
      *        attributes parsing, since local namespace can be defined as
      *        an attribute at this level.
      */
     ret = xmlNewDocNodeEatName(ctxt->myDoc, NULL, name, NULL);
     if (ret == NULL) {
         if (prefix != NULL)
 	    xmlFree(prefix);
 	xmlSAX2ErrMemory(ctxt, "xmlSAX2StartElement");
         return;
     }
     if (ctxt->myDoc->children == NULL) {
 #ifdef DEBUG_SAX_TREE
 	xmlGenericError(xmlGenericErrorContext, "Setting %s as root\n", name);
 #endif
         xmlAddChild((xmlNodePtr) ctxt->myDoc, (xmlNodePtr) ret);
     } else if (parent == NULL) {
         parent = ctxt->myDoc->children;
     }
     ctxt->nodemem = -1;
     if (ctxt->linenumbers) {
 	if (ctxt->input != NULL) {
 	    if (ctxt->input->line < 65535)
 		ret->line = (short) ctxt->input->line;
 	    else
 	        ret->line = 65535;
 	}
     }
 
     /*
      * We are parsing a new node.
      */
 #ifdef DEBUG_SAX_TREE
     xmlGenericError(xmlGenericErrorContext, "pushing(%s)\n", name);
 #endif
-    nodePush(ctxt, ret);
+    if (nodePush(ctxt, ret) < 0) {
+        xmlFreeNode(ret);
+        return;
+    }
 
     /*
      * Link the child element
      */
     if (parent != NULL) {
         if (parent->type == XML_ELEMENT_NODE) {
 #ifdef DEBUG_SAX_TREE
 	    xmlGenericError(xmlGenericErrorContext,
 		    "adding child %s to %s\n", name, parent->name);
 #endif
 	    xmlAddChild(parent, ret);
 	} else {
 #ifdef DEBUG_SAX_TREE
 	    xmlGenericError(xmlGenericErrorContext,
 		    "adding sibling %s to ", name);
 	    xmlDebugDumpOneNode(stderr, parent, 0);
 #endif
 	    xmlAddSibling(parent, ret);
 	}
     }
 
     /*
      * Insert all the defaulted attributes from the DTD especially namespaces
      */
     if ((!ctxt->html) &&
 	((ctxt->myDoc->intSubset != NULL) ||
 	 (ctxt->myDoc->extSubset != NULL))) {
 	xmlCheckDefaultedAttributes(ctxt, name, prefix, atts);
     }
 
     /*
      * process all the attributes whose name start with "xmlns"
      */
     if (atts != NULL) {
         i = 0;
 	att = atts[i++];
 	value = atts[i++];
 	if (!ctxt->html) {
 	    while ((att != NULL) && (value != NULL)) {
 		if ((att[0] == 'x') && (att[1] == 'm') && (att[2] == 'l') &&
 		    (att[3] == 'n') && (att[4] == 's'))
 		    xmlSAX2AttributeInternal(ctxt, att, value, prefix);
 
 		att = atts[i++];
 		value = atts[i++];
 	    }
 	}
     }
 
     /*
      * Search the namespace, note that since the attributes have been
      * processed, the local namespaces are available.
      */
     ns = xmlSearchNs(ctxt->myDoc, ret, prefix);
     if ((ns == NULL) && (parent != NULL))
 	ns = xmlSearchNs(ctxt->myDoc, parent, prefix);
     if ((prefix != NULL) && (ns == NULL)) {
 	ns = xmlNewNs(ret, NULL, prefix);
 	xmlNsWarnMsg(ctxt, XML_NS_ERR_UNDEFINED_NAMESPACE,
 		     "Namespace prefix %s is not defined\n",
 		     prefix, NULL);
     }
 
     /*
      * set the namespace node, making sure that if the default namspace
      * is unbound on a parent we simply kee it NULL
      */
     if ((ns != NULL) && (ns->href != NULL) &&
 	((ns->href[0] != 0) || (ns->prefix != NULL)))
 	xmlSetNs(ret, ns);
 
     /*
      * process all the other attributes
      */
     if (atts != NULL) {
         i = 0;
 	att = atts[i++];
 	value = atts[i++];
 	if (ctxt->html) {
 	    while (att != NULL) {
 		xmlSAX2AttributeInternal(ctxt, att, value, NULL);
 		att = atts[i++];
 		value = atts[i++];
 	    }
 	} else {
 	    while ((att != NULL) && (value != NULL)) {
 		if ((att[0] != 'x') || (att[1] != 'm') || (att[2] != 'l') ||
 		    (att[3] != 'n') || (att[4] != 's'))
 		    xmlSAX2AttributeInternal(ctxt, att, value, NULL);
 
 		/*
 		 * Next ones
 		 */
 		att = atts[i++];
 		value = atts[i++];
 	    }
 	}
     }
 
 #ifdef LIBXML_VALID_ENABLED
     /*
      * If it's the Document root, finish the DTD validation and
      * check the document root element for validity
      */
     if ((ctxt->validate) && (ctxt->vctxt.finishDtd == XML_CTXT_FINISH_DTD_0)) {
 	int chk;
 
 	chk = xmlValidateDtdFinal(&ctxt->vctxt, ctxt->myDoc);
 	if (chk <= 0)
 	    ctxt->valid = 0;
 	if (chk < 0)
 	    ctxt->wellFormed = 0;
 	ctxt->valid &= xmlValidateRoot(&ctxt->vctxt, ctxt->myDoc);
 	ctxt->vctxt.finishDtd = XML_CTXT_FINISH_DTD_1;
     }
 #endif /* LIBXML_VALID_ENABLED */
 
     if (prefix != NULL)
 	xmlFree(prefix);
 
 }
 
 /**
  * xmlSAX2EndElement:
  * @ctx: the user data (XML parser context)
  * @name:  The element name
  *
  * called when the end of an element has been detected.
  */
@@ -2204,246 +2207,249 @@ void
 xmlSAX2StartElementNs(void *ctx,
                       const xmlChar *localname,
 		      const xmlChar *prefix,
 		      const xmlChar *URI,
 		      int nb_namespaces,
 		      const xmlChar **namespaces,
 		      int nb_attributes,
 		      int nb_defaulted,
 		      const xmlChar **attributes)
 {
     xmlParserCtxtPtr ctxt = (xmlParserCtxtPtr) ctx;
     xmlNodePtr ret;
     xmlNodePtr parent;
     xmlNsPtr last = NULL, ns;
     const xmlChar *uri, *pref;
     xmlChar *lname = NULL;
     int i, j;
 
     if (ctx == NULL) return;
     parent = ctxt->node;
     /*
      * First check on validity:
      */
     if (ctxt->validate && (ctxt->myDoc->extSubset == NULL) &&
         ((ctxt->myDoc->intSubset == NULL) ||
 	 ((ctxt->myDoc->intSubset->notations == NULL) &&
 	  (ctxt->myDoc->intSubset->elements == NULL) &&
 	  (ctxt->myDoc->intSubset->attributes == NULL) &&
 	  (ctxt->myDoc->intSubset->entities == NULL)))) {
 	xmlErrValid(ctxt, XML_DTD_NO_DTD,
 	  "Validation failed: no DTD found !", NULL, NULL);
 	ctxt->validate = 0;
     }
 
     /*
      * Take care of the rare case of an undefined namespace prefix
      */
     if ((prefix != NULL) && (URI == NULL)) {
         if (ctxt->dictNames) {
 	    const xmlChar *fullname;
 
 	    fullname = xmlDictQLookup(ctxt->dict, prefix, localname);
 	    if (fullname != NULL)
 	        localname = fullname;
 	} else {
 	    lname = xmlBuildQName(localname, prefix, NULL, 0);
 	}
     }
     /*
      * allocate the node
      */
     if (ctxt->freeElems != NULL) {
         ret = ctxt->freeElems;
 	ctxt->freeElems = ret->next;
 	ctxt->freeElemsNr--;
 	memset(ret, 0, sizeof(xmlNode));
 	ret->type = XML_ELEMENT_NODE;
 
 	if (ctxt->dictNames)
 	    ret->name = localname;
 	else {
 	    if (lname == NULL)
 		ret->name = xmlStrdup(localname);
 	    else
 	        ret->name = lname;
 	    if (ret->name == NULL) {
 	        xmlSAX2ErrMemory(ctxt, "xmlSAX2StartElementNs");
 		return;
 	    }
 	}
 	if ((__xmlRegisterCallbacks) && (xmlRegisterNodeDefaultValue))
 	    xmlRegisterNodeDefaultValue(ret);
     } else {
 	if (ctxt->dictNames)
 	    ret = xmlNewDocNodeEatName(ctxt->myDoc, NULL,
 	                               (xmlChar *) localname, NULL);
 	else if (lname == NULL)
 	    ret = xmlNewDocNode(ctxt->myDoc, NULL, localname, NULL);
 	else
 	    ret = xmlNewDocNodeEatName(ctxt->myDoc, NULL,
 	                               (xmlChar *) lname, NULL);
 	if (ret == NULL) {
 	    xmlSAX2ErrMemory(ctxt, "xmlSAX2StartElementNs");
 	    return;
 	}
     }
     if (ctxt->linenumbers) {
 	if (ctxt->input != NULL) {
 	    if (ctxt->input->line < 65535)
 		ret->line = (short) ctxt->input->line;
 	    else
 	        ret->line = 65535;
 	}
     }
 
     if (parent == NULL) {
         xmlAddChild((xmlNodePtr) ctxt->myDoc, (xmlNodePtr) ret);
     }
     /*
      * Build the namespace list
      */
     for (i = 0,j = 0;j < nb_namespaces;j++) {
         pref = namespaces[i++];
 	uri = namespaces[i++];
 	ns = xmlNewNs(NULL, uri, pref);
 	if (ns != NULL) {
 	    if (last == NULL) {
 	        ret->nsDef = last = ns;
 	    } else {
 	        last->next = ns;
 		last = ns;
 	    }
 	    if ((URI != NULL) && (prefix == pref))
 		ret->ns = ns;
 	} else {
             /*
              * any out of memory error would already have been raised
              * but we can't be guaranteed it's the actual error due to the
              * API, best is to skip in this case
              */
 	    continue;
 	}
 #ifdef LIBXML_VALID_ENABLED
 	if ((!ctxt->html) && ctxt->validate && ctxt->wellFormed &&
 	    ctxt->myDoc && ctxt->myDoc->intSubset) {
 	    ctxt->valid &= xmlValidateOneNamespace(&ctxt->vctxt, ctxt->myDoc,
 	                                           ret, prefix, ns, uri);
 	}
 #endif /* LIBXML_VALID_ENABLED */
     }
     ctxt->nodemem = -1;
 
     /*
      * We are parsing a new node.
      */
-    nodePush(ctxt, ret);
+    if (nodePush(ctxt, ret) < 0) {
+        xmlFreeNode(ret);
+        return;
+    }
 
     /*
      * Link the child element
      */
     if (parent != NULL) {
         if (parent->type == XML_ELEMENT_NODE) {
 	    xmlAddChild(parent, ret);
 	} else {
 	    xmlAddSibling(parent, ret);
 	}
     }
 
     /*
      * Insert the defaulted attributes from the DTD only if requested:
      */
     if ((nb_defaulted != 0) &&
         ((ctxt->loadsubset & XML_COMPLETE_ATTRS) == 0))
 	nb_attributes -= nb_defaulted;
 
     /*
      * Search the namespace if it wasn't already found
      * Note that, if prefix is NULL, this searches for the default Ns
      */
     if ((URI != NULL) && (ret->ns == NULL)) {
         ret->ns = xmlSearchNs(ctxt->myDoc, parent, prefix);
 	if ((ret->ns == NULL) && (xmlStrEqual(prefix, BAD_CAST "xml"))) {
 	    ret->ns = xmlSearchNs(ctxt->myDoc, ret, prefix);
 	}
 	if (ret->ns == NULL) {
 	    ns = xmlNewNs(ret, NULL, prefix);
 	    if (ns == NULL) {
 
 	        xmlSAX2ErrMemory(ctxt, "xmlSAX2StartElementNs");
 		return;
 	    }
             if (prefix != NULL)
                 xmlNsWarnMsg(ctxt, XML_NS_ERR_UNDEFINED_NAMESPACE,
                              "Namespace prefix %s was not found\n",
                              prefix, NULL);
             else
                 xmlNsWarnMsg(ctxt, XML_NS_ERR_UNDEFINED_NAMESPACE,
                              "Namespace default prefix was not found\n",
                              NULL, NULL);
 	}
     }
 
     /*
      * process all the other attributes
      */
     if (nb_attributes > 0) {
         for (j = 0,i = 0;i < nb_attributes;i++,j+=5) {
 	    /*
 	     * Handle the rare case of an undefined atribute prefix
 	     */
 	    if ((attributes[j+1] != NULL) && (attributes[j+2] == NULL)) {
 		if (ctxt->dictNames) {
 		    const xmlChar *fullname;
 
 		    fullname = xmlDictQLookup(ctxt->dict, attributes[j+1],
 		                              attributes[j]);
 		    if (fullname != NULL) {
 			xmlSAX2AttributeNs(ctxt, fullname, NULL,
 			                   attributes[j+3], attributes[j+4]);
 		        continue;
 		    }
 		} else {
 		    lname = xmlBuildQName(attributes[j], attributes[j+1],
 		                          NULL, 0);
 		    if (lname != NULL) {
 			xmlSAX2AttributeNs(ctxt, lname, NULL,
 			                   attributes[j+3], attributes[j+4]);
 			xmlFree(lname);
 		        continue;
 		    }
 		}
 	    }
 	    xmlSAX2AttributeNs(ctxt, attributes[j], attributes[j+1],
 			       attributes[j+3], attributes[j+4]);
 	}
     }
 
 #ifdef LIBXML_VALID_ENABLED
     /*
      * If it's the Document root, finish the DTD validation and
      * check the document root element for validity
      */
     if ((ctxt->validate) && (ctxt->vctxt.finishDtd == XML_CTXT_FINISH_DTD_0)) {
 	int chk;
 
 	chk = xmlValidateDtdFinal(&ctxt->vctxt, ctxt->myDoc);
 	if (chk <= 0)
 	    ctxt->valid = 0;
 	if (chk < 0)
 	    ctxt->wellFormed = 0;
 	ctxt->valid &= xmlValidateRoot(&ctxt->vctxt, ctxt->myDoc);
 	ctxt->vctxt.finishDtd = XML_CTXT_FINISH_DTD_1;
     }
 #endif /* LIBXML_VALID_ENABLED */
 }
 
 /**
  * xmlSAX2EndElementNs:
  * @ctx:  the user data (XML parser context)
  * @localname:  the local name of the element
  * @prefix:  the element namespace prefix if available
  * @URI:  the element namespace name if available
  *
  * SAX2 callback when an element end has been detected by the parser.
  * It provides the namespace informations for the element.
  */