Don't free a partially allocated element type twice (issue
If memory allocation fails for default attributes of an element type
while copying a DTD, the element type itself was being freed.
Unfortunately it's already stored in the DTD by this point, so is
freed again when the DTD is destroyed.
@@ -5884,7 +5884,6 @@ dtdCopy(XML_Parser oldParser, DTD *newDtd, const DTD *oldDtd, const XML_Memory_H
newE->defaultAtts = (DEFAULT_ATTRIBUTE *)
ms->malloc_fcn(oldE->nDefaultAtts * sizeof(DEFAULT_ATTRIBUTE));
if (!newE->defaultAtts) {
- ms->free_fcn(newE);
return 0;
}
}
