[xerces-c] branch xerces-3.2 updated: DFAContentModel::buildSyntaxTree(): fix memory leaks when OutOfMemoryException occurs

This is an automated email from the ASF dual-hosted git repository.

scantor pushed a commit to branch xerces-3.2
in repository https://gitbox.apache.org/repos/asf/xerces-c.git


The following commit(s) were added to refs/heads/xerces-3.2 by this push:
     new c08ac7443 DFAContentModel::buildSyntaxTree(): fix memory leaks when OutOfMemoryException occurs
c08ac7443 is described below

commit c08ac74438f3fff8df30ae1549ad1a9646e160fe
Author: Even Rouault <[email protected]>
AuthorDate: Mon Nov 15 17:32:26 2021 +0100

    DFAContentModel::buildSyntaxTree(): fix memory leaks when OutOfMemoryException occurs
    
    Fixes GDAL's https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=40866
---
 src/xercesc/validators/common/DFAContentModel.cpp | 60 ++++++++++++++---------
 1 file changed, 36 insertions(+), 24 deletions(-)

diff --git a/src/xercesc/validators/common/DFAContentModel.cpp b/src/xercesc/validators/common/DFAContentModel.cpp
index 05f2dcd3f..2ae4b7d8e 100644
--- a/src/xercesc/validators/common/DFAContentModel.cpp
+++ b/src/xercesc/validators/common/DFAContentModel.cpp
@@ -1430,33 +1430,45 @@ CMNode* DFAContentModel::buildSyntaxTree(ContentSpecNode* const curNode
             retNode = buildSyntaxTree(cursor, curIndex);
             for(unsigned int i=0;i<nLoopCount;i++)
             {
-                CMNode* newRight = buildSyntaxTree(rightNode, curIndex);
-                //
-                //  Now handle our level. We use our left child's last pos set and our
-                //  right child's first pos set, so get them now for convenience.
-                //
-                const CMStateSet& last  = retNode->getLastPos();
-                const CMStateSet& first = newRight->getFirstPos();
+                CMNode* newRight = nullptr;
+                try
+                {
+                    newRight = buildSyntaxTree(rightNode, curIndex);
 
-                //
-                //  Now, for every position which is in our left child's last set
-                //  add all of the states in our right child's first set to the
-                //  follow set for that position.
-                //
-                CMStateSetEnumerator enumLast(&last);
-                while(enumLast.hasMoreElements())
+                    //
+                    //  Now handle our level. We use our left child's last pos set and our
+                    //  right child's first pos set, so get them now for convenience.
+                    //
+                    const CMStateSet& last  = retNode->getLastPos();
+                    const CMStateSet& first = newRight->getFirstPos();
+
+                    //
+                    //  Now, for every position which is in our left child's last set
+                    //  add all of the states in our right child's first set to the
+                    //  follow set for that position.
+                    //
+                    CMStateSetEnumerator enumLast(&last);
+                    while(enumLast.hasMoreElements())
+                    {
+                        XMLSize_t index=enumLast.nextElement();
+                        *fFollowList[index] |= first;
+                    }
+
+                    retNode = new (fMemoryManager) CMBinaryOp
+                    (
+                        ContentSpecNode::Sequence
+                        , retNode
+                        , newRight
+                        , fLeafCount
+                        , fMemoryManager
+                    );
+                }
+                catch( const OutOfMemoryException& )
                 {
-                    XMLSize_t index=enumLast.nextElement();
-                    *fFollowList[index] |= first;
+                    delete newRight;
+                    delete retNode;
+                    throw;
                 }
-                retNode = new (fMemoryManager) CMBinaryOp
-                (
-                    ContentSpecNode::Sequence
-                    , retNode
-                    , newRight
-                    , fLeafCount
-                    , fMemoryManager
-                );
             }
             return retNode;
         }