[Expat-bugs] Probable bug in poolGrow in xmlparse.cpp (as of 2.0.1)

[Tim Boddy]

poolGrow in xml.parse.cpp has the following block of code:


  if (pool->blocks && pool->start == pool->blocks->s) {
    int blockSize = (int)(pool->end - pool->start)*2;
    pool->blocks = (BLOCK *)
      pool->mem->realloc_fcn(pool->blocks,
                             (offsetof(BLOCK, s)
                              + blockSize * sizeof(XML_Char)));
    if (pool->blocks == NULL)
      return XML_FALSE;
    pool->blocks->size = blockSize;
    pool->ptr = pool->blocks->s + (pool->ptr - pool->start);
    pool->start = pool->blocks->s;
    pool->end = pool->start + blockSize;
  }
It looks like this will cause a memory leak if realloc_fcn returns NULL because pool->blocks will be overwritten but the old memory area to which it pointed won't be freed.

The other places where reallocation is done in this file (via the REALLOC macro) don't have this bug because they correctly store the result in a temporary variable.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mail.libexpat.org/pipermail/expat-bugs/attachments/20100223/02c8eb6d/attachment.html>