# HG changeset patch # User Olaf Wintermann # Date 1686511425 -7200 # Node ID ea0e059bae725262d1b43214fbc23fb68cdfa8ef # Parent 283d3d7a657ac154cbc65df503b609059161400d fix UAF in dav xml converter diff -r 283d3d7a657a -r ea0e059bae72 libidav/xml.c --- a/libidav/xml.c Sun Jun 11 21:21:34 2023 +0200 +++ b/libidav/xml.c Sun Jun 11 21:23:45 2023 +0200 @@ -74,19 +74,19 @@ while(stack->size > 0) { ConvXmlElm *c = cxListAt(stack, 0); + xmlNode *n = c->node; + DavXmlNode *c_parent = c->parent; + DavXmlNode *prev = NULL; cxListRemove(stack, 0); - - xmlNode *n = c->node; - DavXmlNode *prev = NULL; while(n) { DavXmlNode *newxn = cxCalloc(a, 1, sizeof(DavXmlNode)); if(!ret) { ret = newxn; } newxn->type = convert_type(n->type); - newxn->parent = c->parent; - if(c->parent && !c->parent->children) { - c->parent->children = newxn; + newxn->parent = c_parent; + if(c_parent && !c_parent->children) { + c_parent->children = newxn; } newxn->prev = prev; if(prev) {