Hi Daniel, This problem is the same as d7958b21e7f8c447a26bb2436f08402b2c308be4. The operation "CTXT->nameMax * = 2;" should be placed under the function call of xmlRealloc().
Signed-off-by: Xia Xinfeng <xi...@cn.fujitsu.com> --- parser.c | 5 ++--- 1 files changed, 2 insertions(+), 3 deletions(-) diff --git a/parser.c b/parser.c index 826284c..21d7aa3 100755 --- a/parser.c +++ b/parser.c @@ -1820,15 +1820,14 @@ namePush(xmlParserCtxtPtr ctxt, const xmlChar * value) if (ctxt->nameNr >= ctxt->nameMax) { const xmlChar * *tmp; - ctxt->nameMax *= 2; tmp = (const xmlChar * *) xmlRealloc((xmlChar * *)ctxt->nameTab, - ctxt->nameMax * + ctxt->nameMax * 2 * sizeof(ctxt->nameTab[0])); if (tmp == NULL) { - ctxt->nameMax /= 2; goto mem_error; } ctxt->nameTab = tmp; + ctxt->nameMax *= 2; } ctxt->nameTab[ctxt->nameNr] = value; ctxt->name = value; -- 1.5.5.1 _______________________________________________ xml mailing list, project page http://xmlsoft.org/ xml@gnome.org http://mail.gnome.org/mailman/listinfo/xml