From: Rhodri James <rhodri@kynesim.co.uk>
Date: Tue, 7 Mar 2017 15:28:58 +0000 (+0000)
Subject: Restore groupSize if (re)allocation of groupConnector fails
X-Git-Tag: R_2_2_3~27^2~14
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=a7884ded3149c0d7d5901093cf2da39b5b2f292e;p=libexpat

Restore groupSize if (re)allocation of groupConnector fails
---

diff --git a/expat/lib/xmlparse.c b/expat/lib/xmlparse.c
index fd08b4ec..ba1fd9ae 100644
--- a/expat/lib/xmlparse.c
+++ b/expat/lib/xmlparse.c
@@ -4832,8 +4832,10 @@ doProlog(XML_Parser parser,
       if (prologState.level >= groupSize) {
         if (groupSize) {
           char *temp = (char *)REALLOC(groupConnector, groupSize *= 2);
-          if (temp == NULL)
+          if (temp == NULL) {
+            groupSize /= 2;
             return XML_ERROR_NO_MEMORY;
+          }
           groupConnector = temp;
           if (dtd->scaffIndex) {
             int *temp = (int *)REALLOC(dtd->scaffIndex,
@@ -4845,8 +4847,10 @@ doProlog(XML_Parser parser,
         }
         else {
           groupConnector = (char *)MALLOC(groupSize = 32);
-          if (!groupConnector)
+          if (!groupConnector) {
+            groupSize = 0;
             return XML_ERROR_NO_MEMORY;
+          }
         }
       }
       groupConnector[prologState.level] = 0;