RootCauseunvalidated
entity boundaries break the symmetric push/pop pairing. Tension: the freed node pointer remains in vstate. Outcome: xmlValidatePopElement uses state->node in xmlErrValidNode("Element %s ...", state->node->name, ...) — this is the UAF read.
67f1fbef-f2cd-4b8a-b10b-ff061abfed93
entity boundaries break the symmetric push/pop pairing. Tension: the freed node pointer remains in vstate. Outcome: xmlValidatePopElement uses state->node in xmlErrValidNode("Element %s ...", state->node->name, ...) — this is the UAF read.