[xerces-c] 02/02: DFAContentModel::buildDFA(): correctly zero-initialize fFollowList

This is an automated email from the ASF dual-hosted git repository.

scantor pushed a commit to branch xerces-3.2
in repository https://gitbox.apache.org/repos/asf/xerces-c.git

commit d80edf41bdcdf8a98c551b5ca5c3c4219b6b5873
Author: Even Rouault <[email protected]>
AuthorDate: Mon Dec 20 20:13:02 2021 +0100

    DFAContentModel::buildDFA(): correctly zero-initialize fFollowList
    
    Due to a copy&paste issue, the intended zero-initialization of
    fFollowList wasn't done (copy&paste issue), and thus in case of
    OutOfMemory exception when initializing the array, the memory freeing in
    cleanup() could access uninitialized elements.
    
    Follow-up of https://github.com/apache/xerces-c/pull/40 / a65990d79d3fc333d7481f010da4e165a88b6cb3
    
    Fixes GDAL's https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=42636
---
 src/xercesc/validators/common/DFAContentModel.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/xercesc/validators/common/DFAContentModel.cpp b/src/xercesc/validators/common/DFAContentModel.cpp
index 56d77311d..c14ae7b57 100644
--- a/src/xercesc/validators/common/DFAContentModel.cpp
+++ b/src/xercesc/validators/common/DFAContentModel.cpp
@@ -682,7 +682,7 @@ void DFAContentModel::buildDFA(ContentSpecNode* const curNode)
     (
         fLeafCount * sizeof(CMStateSet*)
     ); //new CMStateSet*[fLeafCount];
-    memset(fLeafList, 0, fLeafCount*sizeof(CMStateSet*));
+    memset(fFollowList, 0, fLeafCount*sizeof(CMStateSet*));
     for (index = 0; index < fLeafCount; index++)
         fFollowList[index] = new (fMemoryManager) CMStateSet(fLeafCount, fMemoryManager);