Sun, 11 Jun 2023 21:23:45 +0200
fix UAF in dav xml converter
libidav/xml.c | file | annotate | diff | comparison | revisions |
--- a/libidav/xml.c Sun Jun 11 21:21:34 2023 +0200 +++ b/libidav/xml.c Sun Jun 11 21:23:45 2023 +0200 @@ -74,19 +74,19 @@ while(stack->size > 0) { ConvXmlElm *c = cxListAt(stack, 0); + xmlNode *n = c->node; + DavXmlNode *c_parent = c->parent; + DavXmlNode *prev = NULL; cxListRemove(stack, 0); - - xmlNode *n = c->node; - DavXmlNode *prev = NULL; while(n) { DavXmlNode *newxn = cxCalloc(a, 1, sizeof(DavXmlNode)); if(!ret) { ret = newxn; } newxn->type = convert_type(n->type); - newxn->parent = c->parent; - if(c->parent && !c->parent->children) { - c->parent->children = newxn; + newxn->parent = c_parent; + if(c_parent && !c_parent->children) { + c_parent->children = newxn; } newxn->prev = prev; if(prev) {