CVE-2021-3518 libxml2 use-after-free in xmlXIncludeCopyNode during recursive XInclude

libxml2 v2.9.11 has a use-after-free vulnerability (CVE-2021-3518) in XInclude processing when handling recursive/nested includes. The XInclude context (xmlXIncludeCtxt) keeps a side-table of include references (incTab) where each entry stores a raw xmlNodePtr (->ref) into the source tree. During recursive XInclude expansion, xmlXIncludeIncludeNode in xinclude.c frees fallback children of an XInclude element via xmlUnlinkNode/xmlFreeNode at lines 2253-2259, but it does NOT invalidate incTab entries whose ->ref pointers live inside that freed subtree. Subsequent passes — xmlXIncludeIncludeNode line 2201 ('cur = ctxt->incTab[nr]->ref'), xmlXIncludeCopyNode line 844 ('xmlDocCopyNode(elem, target, 1)'), and xmlXIncludeCopyNodeList line 868 walking 'cur->next' — dereference these dangling pointers. The 'count' refcount used in xmlXIncludeRecurseDoc only protects the xmlXIncludeRefPtr wrapper struct, not the xmlNodePtr it wraps. 1. Listed xinclude.c (2657 lines) and grepped for the key functions: xmlXIncludeCopyNode, xmlXIncludeCopyRange, xmlXIncludeRecurseDoc, xmlXIncludeAddNode, xmlXIncludeLoadNode, xmlXIncludeIncludeNode. 2. Read xmlXIncludeCopyNode at lines 831-846 — copies via xmlDocCopyNode without any guard that elem is still valid. 3. Read xmlXIncludeIncludeNode at 2185-2284 — line 2253 reassigns cur->type to XML_XINCLUDE_START and lines 2255-2259 free all current children (the fallback subtree). 4. Read xmlXIncludeRecurseDoc at 666-760 — 'count' increments protect refs from freeing, but only at the wrapper level; the underlying xmlNodePtr is not refcounted. 5. Read xmlXIncludeLoadDoc at 1408+ — calls xmlXIncludeRecurseDoc(ctxt, doc, URL) at line 1557 BEFORE xmlXIncludeCopyNodeList at line 1564, so by the time the copy happens, the recursive pass may have freed nodes that are still referenced elsewhere via incTab. The trigger is a cycle / nested fallback that registers an inner XInclude whose ref node lives in another XInclude's fallback subtree. <solution_description">Upstream fix (commit 1358d157d0bd at gitlab.gnome.org/GNOME/libxml2): track the set of documents currently being processed and refuse recursion into a document already in progress, plus invalidate stale incTab refs. Practical patch: in xmlXIncludeIncludeNode, before freeing fallback children, walk ctxt->incTab and NULL out any ->ref that points into the subtree being freed. Add NULL-checks at xmlXIncludeIncludeNode:2202 and xmlXIncludeLoadNode:2053 before dereferencing the ref. Also add cycle detection in xmlXIncludeRecurseDoc so the same URL isn't processed while outer-ctxt pointers into it are alive. Confirmed by reading the exact freeing site (xinclude.c:2253-2259) and the dereference sites (2201, 844, 868). The data flow: xmlXIncludeLoadDoc -> xmlXIncludeRecurseDoc -> xmlXIncludeDoProcess -> xmlXIncludeIncludeNode (frees) -> outer ctxt resumes -> xmlXIncludeCopyNodeList (UAF). A crafted XML with nested xi:include inside xi:fallback whose href creates a cycle reproduces it under ASAN as heap-use-after-free in xmlXIncludeCopyNode. heap-use-after-free