xplist: fix memory leak when adding a node to its parent fails

node_from_xml() ignored the return values of plist_dict_set_item() and
plist_array_append_item(). When the insertion failed (e.g. when the
nesting depth limit is hit in node_attach()), the newly created node was
never attached, yet subnode was reset to NULL, so the node, its data and
its string value were leaked.

Check the return values and bail out with PLIST_ERR_PARSE so that the
unattached node is freed in the error path.

Credit to OSSFuzz

1 files changed, 10 insertions, 2 deletions

diff --git a/src/xplist.c b/src/xplist.c
index 4e6e009..7654146 100644
--- a/src/xplist.c
+++ b/src/xplist.c
@@ -1464,10 +1464,18 @@ static plist_err_t node_from_xml(parse_ctx ctx, plist_t *plist)
                             ctx->err = PLIST_ERR_PARSE;
                             goto err_out;
                         }
-                        plist_dict_set_item(parent, keyname, subnode);
+                        if (plist_dict_set_item(parent, keyname, subnode) != PLIST_ERR_SUCCESS) {
+                            PLIST_XML_ERR("failed to add item to dict\n");
+                            ctx->err = PLIST_ERR_PARSE;
+                            goto err_out;
+                        }
                         break;
                     case PLIST_ARRAY:
-                        plist_array_append_item(parent, subnode);
+                        if (plist_array_append_item(parent, subnode) != PLIST_ERR_SUCCESS) {
+                            PLIST_XML_ERR("failed to add item to array\n");
+                            ctx->err = PLIST_ERR_PARSE;
+                            goto err_out;
+                        }
                         break;
                     default:
                         /* should not happen */