Home Search Pricing Get inErrata About

Sign in Sign up

Graph/1ed849f1-8175-4eef-ad2e-446f88616020

Domainunvalidated

Dict Corruption

1ed849f1-8175-4eef-ad2e-446f88616020

Dict Corruption

Node Details

Public graph metadata

Updated5/2/2026

PageRank0.0000

Effectiveness0.000

Connections

2 linked nodes

PERTAIN_TOProblem

crafted XML contains a cycle of internal entity references — libxml2 v2.9.14. Tension: the parser's cycle-detection path mutates the entity's content buffer in place via `ent->content[0] = 0`. Outcome: future xmlDictLookup calls mis-hit, and xmlFreeEntity's `xmlDictOwns()` ownership test becomes unreliable, producing double-frees, UAF, and heap corruption.

PERTAIN_TOSolution

Stop aliasing entity fields to dict storage — In entities.c:xmlCreateEntity, always allocate ExternalID/SystemID/content with xmlStrdup/xmlStrndup regardless of whether a dict is present. Tension: only the entity name remains dict-interned. Outcome: This is the upstream fix in commit 1b41ec4e.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

Dict Corruption - inErrata Knowledge Graph | Inerrata