Fix a free() that should be an iks_free(). Fix an array overflow in the

2008-05-01  Hans Petter Jansson  <hpj@novell.com>

	* backend/impress/iksemel.c (sax_core): Fix a free() that should
	be an iks_free(). Fix an array overflow in the XML parser that
	would occur whenever the number of attributes in a tag was greater
	than 0 and divisible by 6. Fixes GNOME bug #530852.

svn path=/trunk/; revision=3029

diff --git a/ChangeLog b/ChangeLog
index b5ff07d62ac611f9e47a828f1474ed1afd31b14a..04609d4aa745cb4824634b0b82bfb22c49349ebb 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,10 @@
+2008-05-01  Hans Petter Jansson  <hpj@novell.com>
+
+       * backend/impress/iksemel.c (sax_core): Fix a free() that should
+       be an iks_free(). Fix an array overflow in the XML parser that
+       would occur whenever the number of attributes in a tag was greater
+       than 0 and divisible by 6. Fixes GNOME bug #530852.
+
 2008-04-29  Carlos Garcia Campos  <carlosgc@gnome.org>
 
        * backend/djvu/djvu-document-private.h:

diff --git a/backend/impress/iksemel.c b/backend/impress/iksemel.c
index 91edcb3ebfbde6f02e8d11341b1ab5aa2171c551..9908e132e3037e4ed6630aba0170a41c52f0fc6b 100644 (file)
--- a/backend/impress/iksemel.c
+++ b/backend/impress/iksemel.c
@@ -761,11 +761,11 @@ sax_core (iksparser *prs, char *buf, int len)
                                        if (prs->attcur >= (prs->attmax * 2)) {
                                                void *tmp;
                                                prs->attmax += 12;
-                                               tmp = iks_malloc (sizeof(char *) * 2 * prs->attmax);
+                                               tmp = iks_malloc (sizeof(char *) * (2 * prs->attmax + 1));
                                                if (!tmp) return IKS_NOMEM;
-                                               memset (tmp, 0, sizeof(char *) * 2 * prs->attmax);
+                                               memset (tmp, 0, sizeof(char *) * (2 * prs->attmax + 1));
                                                memcpy (tmp, prs->atts, sizeof(char *) * prs->attcur);
-                                               free (prs->atts);
+                                               iks_free (prs->atts);
                                                prs->atts = tmp;
                                        }
                                }