commit 621c222efe87946ad8e53f59e28c782979d340c8
author Nick Wellnhofer <wellnhofer@aevum.de> Mon Jan 30 15:48:11 2023 +0100
committer Nick Wellnhofer <wellnhofer@aevum.de> Fri Feb 03 12:40:15 2023 +0100
tree ca35b1977808a1ccdb542ccc3a0de43dfeedb8bb
parent 755344013e161ab7c982290c6c78903bd9bd300e

malloc-fail: Fix error check in xmlXPathCompareValues

Avoid null deref.

Found with libFuzzer, see #344.

xpath.c

diff --git a/xpath.c b/xpath.c
index 5cacc2c..81d4b50 100644
--- a/xpath.c
+++ b/xpath.c
@@ -7408,21 +7408,13 @@
 	valuePush(ctxt, arg1);
 	xmlXPathNumberFunction(ctxt, 1);
 	arg1 = valuePop(ctxt);
-    }
-    if (arg1->type != XPATH_NUMBER) {
-	xmlXPathFreeObject(arg1);
-	xmlXPathFreeObject(arg2);
-	XP_ERROR0(XPATH_INVALID_OPERAND);
+        CHECK_ERROR0;
     }
     if (arg2->type != XPATH_NUMBER) {
 	valuePush(ctxt, arg2);
 	xmlXPathNumberFunction(ctxt, 1);
 	arg2 = valuePop(ctxt);
-    }
-    if (arg2->type != XPATH_NUMBER) {
-	xmlXPathReleaseObject(ctxt->context, arg1);
-	xmlXPathReleaseObject(ctxt->context, arg2);
-	XP_ERROR0(XPATH_INVALID_OPERAND);
+        CHECK_ERROR0;
     }
     /*
      * Add tests for infinity and nan