libcomps
libcomps copied to clipboard
possible double-free in comps_doc.c if xmlTextWriter functions fail
In function comps_doc_xml() in comps_doc.c, the dict
object is destroyed at https://github.com/rpm-software-management/libcomps/blob/2ed0fe52d1e7c062a5a42968bb7a7680835914b8/libcomps/src/comps_doc.c#L731 , however there are many other error paths where the object is destroyed again, possibly causing double-free (e.g. https://github.com/rpm-software-management/libcomps/blob/2ed0fe52d1e7c062a5a42968bb7a7680835914b8/libcomps/src/comps_doc.c#L737).
This was probably the result of a wrong copy-paste, where dict
should have been replaced with mdict
but it wasn't.