From c06bf51afb41bd9f03740c2e2b625fe461b2be58 Mon Sep 17 00:00:00 2001
From: Joel Goguen <jgoguen@jgoguen.ca>
Date: Sun, 19 Apr 2026 21:26:45 -0400
Subject: [PATCH] fix: harden OPDS parser cleanup after errors

Fix potential use-after-free or double-free issue in the OPDS parser by
nulling it after free and guarding against using a nullptr parser in
`flush()`.
---
 lib/OpdsParser/OpdsParser.cpp | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/OpdsParser/OpdsParser.cpp b/lib/OpdsParser/OpdsParser.cpp
index 45d92eaa..647d4fcf 100644
--- a/lib/OpdsParser/OpdsParser.cpp
+++ b/lib/OpdsParser/OpdsParser.cpp
@@ -40,6 +40,7 @@ size_t OpdsParser::write(const uint8_t* xmlData, const size_t length) {
     if (!buf) {
       errorOccured = true;
       XML_ParserFree(parser);
+      parser = nullptr;
       return length;
     }
 
@@ -49,6 +50,7 @@ size_t OpdsParser::write(const uint8_t* xmlData, const size_t length) {
     if (XML_ParseBuffer(parser, static_cast<int>(toRead), 0) == XML_STATUS_ERROR) {
       errorOccured = true;
       XML_ParserFree(parser);
+      parser = nullptr;
       return length;
     }
     currentPos += toRead;
@@ -58,6 +60,10 @@ size_t OpdsParser::write(const uint8_t* xmlData, const size_t length) {
 }
 
 void OpdsParser::flush() {
+  if (!parser) {
+    errorOccured = true;
+    return;
+  }
   if (XML_Parse(parser, nullptr, 0, XML_TRUE) != XML_STATUS_OK) {
     errorOccured = true;
     XML_ParserFree(parser);