DO NOT MERGE: Heap buffer overflow in xmlAddID
Patch from ddkilzer@apple.com
See https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=598
and https://bugzilla.gnome.org/show_bug.cgi?id=780228
Bug: 37104170
Change-Id: I0286459ff9066b664dc26f7f1ff65a1388de3d92
diff --git a/valid.c b/valid.c
index 19f84b8..aee6f40 100644
--- a/valid.c
+++ b/valid.c
@@ -4623,13 +4623,13 @@
/* Validity Constraint: ID uniqueness */
if (attrDecl->atype == XML_ATTRIBUTE_ID) {
- if (xmlAddID(ctxt, doc, value, (xmlAttrPtr) ns) == NULL)
+ if (xmlAddID(ctxt, doc, value, (xmlAttrPtr) attrDecl) == NULL)
ret = 0;
}
if ((attrDecl->atype == XML_ATTRIBUTE_IDREF) ||
(attrDecl->atype == XML_ATTRIBUTE_IDREFS)) {
- if (xmlAddRef(ctxt, doc, value, (xmlAttrPtr) ns) == NULL)
+ if (xmlAddRef(ctxt, doc, value, (xmlAttrPtr) attrDecl) == NULL)
ret = 0;
}