commit efd0e73a5c4c8834eb49af6eff93ebf37174d2a1
author Brian C. Young <bcyoung@google.com> Thu Apr 06 17:02:29 2017 -0700
committer JP Sugarbroad <jpsugar@google.com> Thu Apr 13 19:56:01 2017 +0000
tree 528e6efabb3e38180f3079eefd977b08f2908034
parent cb49e764a467ce03c0da861c7d05fa75dcd4d915

DO NOT MERGE: Heap buffer overflow in xmlAddID

Patch from ddkilzer@apple.com
See https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=598
and https://bugzilla.gnome.org/show_bug.cgi?id=780228

Bug: 37104170
Change-Id: I0286459ff9066b664dc26f7f1ff65a1388de3d92
(cherry picked from commit e8226ac67362d9d9ce793bb539ab597eddc5a1a3)

valid.c

diff --git a/valid.c b/valid.c
index 19f84b8..aee6f40 100644
--- a/valid.c
+++ b/valid.c
@@ -4623,13 +4623,13 @@
 
     /* Validity Constraint: ID uniqueness */
     if (attrDecl->atype == XML_ATTRIBUTE_ID) {
-        if (xmlAddID(ctxt, doc, value, (xmlAttrPtr) ns) == NULL)
+        if (xmlAddID(ctxt, doc, value, (xmlAttrPtr) attrDecl) == NULL)
 	    ret = 0;
     }
 
     if ((attrDecl->atype == XML_ATTRIBUTE_IDREF) ||
 	(attrDecl->atype == XML_ATTRIBUTE_IDREFS)) {
-        if (xmlAddRef(ctxt, doc, value, (xmlAttrPtr) ns) == NULL)
+        if (xmlAddRef(ctxt, doc, value, (xmlAttrPtr) attrDecl) == NULL)
 	    ret = 0;
     }