This is an automated email from the ASF dual-hosted git repository.
scantor pushed a commit to branch xerces-3.2
in repository https://gitbox.apache.org/repos/asf/xerces-c.git
The following commit(s) were added to refs/heads/xerces-3.2 by this push:
new c08ac7443 DFAContentModel::buildSyntaxTree(): fix memory leaks when
OutOfMemoryException occurs
c08ac7443 is described below
commit c08ac74438f3fff8df30ae1549ad1a9646e160fe
Author: Even Rouault <even.roua...@spatialys.com>
AuthorDate: Mon Nov 15 17:32:26 2021 +0100
DFAContentModel::buildSyntaxTree(): fix memory leaks when
OutOfMemoryException occurs
Fixes GDAL's https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40866
---
src/xercesc/validators/common/DFAContentModel.cpp | 60 ++++++++++++++---------
1 file changed, 36 insertions(+), 24 deletions(-)
diff --git a/src/xercesc/validators/common/DFAContentModel.cpp
b/src/xercesc/validators/common/DFAContentModel.cpp
index 05f2dcd3f..2ae4b7d8e 100644
--- a/src/xercesc/validators/common/DFAContentModel.cpp
+++ b/src/xercesc/validators/common/DFAContentModel.cpp
@@ -1430,33 +1430,45 @@ CMNode*
DFAContentModel::buildSyntaxTree(ContentSpecNode* const curNode
retNode = buildSyntaxTree(cursor, curIndex);
for(unsigned int i=0;i<nLoopCount;i++)
{
- CMNode* newRight = buildSyntaxTree(rightNode, curIndex);
- //
- // Now handle our level. We use our left child's last pos set
and our
- // right child's first pos set, so get them now for
convenience.
- //
- const CMStateSet& last = retNode->getLastPos();
- const CMStateSet& first = newRight->getFirstPos();
+ CMNode* newRight = nullptr;
+ try
+ {
+ newRight = buildSyntaxTree(rightNode, curIndex);
- //
- // Now, for every position which is in our left child's last
set
- // add all of the states in our right child's first set to the
- // follow set for that position.
- //
- CMStateSetEnumerator enumLast(&last);
- while(enumLast.hasMoreElements())
+ //
+ // Now handle our level. We use our left child's last pos
set and our
+ // right child's first pos set, so get them now for
convenience.
+ //
+ const CMStateSet& last = retNode->getLastPos();
+ const CMStateSet& first = newRight->getFirstPos();
+
+ //
+ // Now, for every position which is in our left child's
last set
+ // add all of the states in our right child's first set
to the
+ // follow set for that position.
+ //
+ CMStateSetEnumerator enumLast(&last);
+ while(enumLast.hasMoreElements())
+ {
+ XMLSize_t index=enumLast.nextElement();
+ *fFollowList[index] |= first;
+ }
+
+ retNode = new (fMemoryManager) CMBinaryOp
+ (
+ ContentSpecNode::Sequence
+ , retNode
+ , newRight
+ , fLeafCount
+ , fMemoryManager
+ );
+ }
+ catch( const OutOfMemoryException& )
{
- XMLSize_t index=enumLast.nextElement();
- *fFollowList[index] |= first;
+ delete newRight;
+ delete retNode;
+ throw;
}
- retNode = new (fMemoryManager) CMBinaryOp
- (
- ContentSpecNode::Sequence
- , retNode
- , newRight
- , fLeafCount
- , fMemoryManager
- );
}
return retNode;
}
---------------------------------------------------------------------
To unsubscribe, e-mail: c-dev-unsubscr...@xerces.apache.org
For additional commands, e-mail: c-dev-h...@xerces.apache.org
