CVE-2024-25062 libxml2 use-after-free in xmlTextReaderValidateEntity

CVE-2024-25062 — Use-after-free in libxml2's XML Reader (xmlreader.c) when DTD validation is enabled and the document contains entity references. The function xmlTextReaderValidateEntity() walks the entity expansion subtree and, while traversing back up via node->parent, frees the parent's last children unconditionally (apart from a NODE_IS_PRESERVED check) when reader->entNr == 0. The cached pointer oldnode = reader->node (saved at function entry) is not invalidated when it is one of those last children, so the function later writes the dangling pointer back via reader->node = oldnode;. Subsequent reads/derefs of reader->node trigger UAF. Affected: libxml2 < 2.11.7 / < 2.12.5.