Fix potential crash bug in mxmldoc (Issue #235, Issue #236)

6 years ago · 1afcfdbeb6
parent 01e2e50f17
commit 1afcfdbeb6
3 changed files with 4 additions and 2 deletions
--- a/CHANGES.md
+++ b/CHANGES.md
@ -1,5 +1,7 @@
 # Changes in Mini-XML CURRENT

+- Fixed a potential crash bug in mxmldoc found by fuzzing (Issue #235,
+  Issue #236)
 - The `mxmldoc` program now sets the EPUB subject ("Programming").


--- a/doc/mxml.man
+++ b/doc/mxml.man
@ -1,4 +1,4 @@
-.TH mxml 3 "Mini-XML API" "10/02/18" "Mini-XML API"
+.TH mxml 3 "Mini-XML API" "12/01/18" "Mini-XML API"
 .SH NAME
 mxml \- Mini-XML API
 .SH INCLUDE FILE
--- a/mxmldoc.c
+++ b/mxmldoc.c
@ -3792,7 +3792,7 @@ write_element(FILE        *out,		/* I - Output file */
        write_string(out, node->value.text.string, mode);
    }

-  if (!strcmp(element->value.element.name, "type") &&
+  if (!strcmp(element->value.element.name, "type") && element->last_child &&
      element->last_child->value.text.string[0] != '*')
    putc(' ', out);
 }