(axis-axis2-c-core) 09/12: Keep the element frame when Guththila rejects an end tag

[ro...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

robertlazarski pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/axis-axis2-c-core.git

commit 94c5602deb7a93d644609f2ed2a3b9c53551975c
Author: Robert Lazarski <ro...@gmail.com>
AuthorDate: Sun Sep 27 07:19:25 2026 -1000

    Keep the element frame when Guththila rejects an end tag
    
    A mismatched end tag returned with its element frame already popped, so the
    frame and its tokens leaked. It is pushed back and freed with the stack. The
    input that found it is added to the XML seed corpus.
    
    Co-Authored-By: Claude Opus 5.5 (1M context) <no...@anthropic.com>
---
 fuzz/corpus/xml/mismatched_end_tag.xml |  2 ++
 guththila/src/guththila_xml_parser.c   | 18 +++++++++++-------
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/fuzz/corpus/xml/mismatched_end_tag.xml b/fuzz/corpus/xml/mismatched_end_tag.xml
new file mode 100644
index 000000000..8e13e71e1
--- /dev/null
+++ b/fuzz/corpus/xml/mismatched_end_tag.xml
@@ -0,0 +1,2 @@
+<?xml version="1.0"?>
+<root attr="value"><child>text</child></root<?xml version="1.0"?>
diff --git a/guththila/src/guththila_xml_parser.c b/guththila/src/guththila_xml_parser.c
index 0db2edd70..30515bd82 100644
--- a/guththila/src/guththila_xml_parser.c
+++ b/guththila/src/guththila_xml_parser.c
@@ -1038,15 +1038,19 @@ guththila_next(
 
 #ifdef GUTHTHILA_VALIDATION_PARSER	
                     elem = (guththila_element_t *)guththila_stack_pop(&m->elem, env);
-                    if(!elem || (!elem->prefix && m->prefix) || (elem->prefix && !m->prefix))
+                    if(!elem)
                         return -1;
-                    if(guththila_tok_tok_cmp(m->name, elem->name, env))
-                    {
-                        return -1;
-                    }
-                    if(elem->prefix && m->prefix && guththila_tok_tok_cmp(m->prefix, elem->prefix,
-                        env))
+                    /* A mismatched end tag is an error, but the frame just
+                     * popped is still owned by the parser: push it back so
+                     * guththila_un_init frees it with the rest of the stack.
+                     * Returning with it popped leaked the frame and its
+                     * tokens on every malformed end tag. */
+                    if((!elem->prefix && m->prefix) || (elem->prefix && !m->prefix)
+                        || guththila_tok_tok_cmp(m->name, elem->name, env)
+                        || (elem->prefix && m->prefix
+                            && guththila_tok_tok_cmp(m->prefix, elem->prefix, env)))
                     {
+                        guththila_stack_push(&m->elem, elem, env);
                         return -1;
                     }
                     /* Releasing the namespace related resources */