From b59c28bdbd33f2a119c0f353d6d4376736bd6602 Mon Sep 17 00:00:00 2001
From: Andrey Volk <andywolk@gmail.com>
Date: Sun, 25 Apr 2021 04:12:50 +0300
Subject: [PATCH] [Core] scan-build: fix false-positive use-after-free in
 switch_xml_internal_dtd()

---
 src/switch_xml.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/switch_xml.c b/src/switch_xml.c
index b05358741c..94268da358 100644
--- a/src/switch_xml.c
+++ b/src/switch_xml.c
@@ -839,6 +839,8 @@ static short switch_xml_internal_dtd(switch_xml_root_t root, char *s, switch_siz
 		if (!*s)
 			break;
 		else if (!strncmp(s, "<!ENTITY", 8)) {	/* parse entity definitions */
+			int use_pe;
+
 			c = s += strspn(s + 8, SWITCH_XML_WS) + 8;	/* skip white space separator */
 			n = s + strspn(s, SWITCH_XML_WS "%");	/* find name */
 			*(s = n + strcspn(n, SWITCH_XML_WS)) = ';';	/* append ; to name */
@@ -849,10 +851,11 @@ static short switch_xml_internal_dtd(switch_xml_root_t root, char *s, switch_siz
 				continue;
 			}
 
-			for (i = 0, ent = (*c == '%') ? pe : root->ent; ent[i]; i++);
+			use_pe = (*c == '%');
+			for (i = 0, ent = (use_pe) ? pe : root->ent; ent[i]; i++);
 			sstmp = (char **) switch_must_realloc(ent, (i + 3) * sizeof(char *));	/* space for next ent */
 			ent = sstmp;
-			if (*c == '%')
+			if (use_pe)
 				pe = ent;
 			else
 				root->ent = ent;