Home Search Pricing Get inErrata About

Sign in Sign up

Graph/libxml2

Component

libxml2

libxml2

libxml2

Node Details

Public graph metadata

Updated5/1/2026

Connections

20 linked nodes

WRITTEN_INLanguage

SUPPORTSLanguage

RELATES_TODomain

AFFECTSRootCause

The XInclude expansion check executes immediately after without verifying the reader's backtracking state — During backtracking in the XML parsing state machine. Tension: leading to access of freed memory when dereferencing freed node pointers. Outcome: The root cause is missing state verification between destructive cleanup and subsequent node access operations.

AFFECTSRootCause

xmlCreateEntity() in entities.c stores short (<5 byte) entity content, plus ExternalID/SystemID, by calling xmlDictLookup(dict, ...). Tension: The in-place zeroing therefore corrupts the dict: the stored hash no longer matches the mutated string. Outcome: the diff modifies entities.c xmlCreateEntity + xmlFreeEntity to stop using the dict for content/ExternalID/SystemID/orig and use xmlStrdup instead.

AFFECTSSolution

Stop aliasing entity fields to dict storage — In entities.c:xmlCreateEntity, always allocate ExternalID/SystemID/content with xmlStrdup/xmlStrndup regardless of whether a dict is present. Tension: only the entity name remains dict-interned. Outcome: This is the upstream fix in commit 1b41ec4e.

AFFECTSRootCause

xmlParseCDSect function uses an int-typed size variable that doubles repeatedly (size *= 2) without overflow checks — xmlParseCDSect function at line 9763. Outcome: size limit check happens AFTER vulnerable realloc.

AFFECTSRootCause

at lines 4448/4500. Tension: The ptrdiff_t result is truncated to int, yielding a corrupted length. Outcome: `needSize = buf->use + len + 1` can produce an incorrectly small result.

AFFECTSRootCause

Tension: if the entity content is allocated from the shared dict, this corrupts the dict entry.

AFFECTSSolution

Change line 456 from 'if (name == NULL) return(0);' to 'if ((name == NULL) || (namelen <= 0)) return(value);' — in dict.c. Tension: to validate length before dereferencing. Outcome: Fix in commit 547edbf1cbdc.

PERTAIN_TOSolution

Add state check before XInclude expansion at line 1445 — at line 1445. Outcome: This prevents XInclude expansion code from executing while the reader is in backtracking state.

PERTAIN_TOProblem

crafted XML contains a cycle of internal entity references — libxml2 v2.9.14. Tension: the parser's cycle-detection path mutates the entity's content buffer in place via `ent->content[0] = 0`. Outcome: future xmlDictLookup calls mis-hit, and xmlFreeEntity's `xmlDictOwns()` ownership test becomes unreliable, producing double-frees, UAF, and heap corruption.

PERTAIN_TOSolution

Stop aliasing entity fields to dict storage — In entities.c:xmlCreateEntity, always allocate ExternalID/SystemID/content with xmlStrdup/xmlStrndup regardless of whether a dict is present. Tension: only the entity name remains dict-interned. Outcome: This is the upstream fix in commit 1b41ec4e.

PERTAIN_TOSolution

Patch: Move `xmlFree(URI)` to inside both error and success branches — In the error path (`if (URL == NULL)`), first call `xmlXIncludeErr` with `URI` (still valid). Tension: This was fixed in commit 5a19e216 in libxml2 post-2.9.11. Outcome: then call `xmlFree(URI)`.

PERTAIN_TOProblem

libxml2 v2.9.14 during CDATA section parsing. Tension: Subsequent writes cause heap overflow, enabling memory corruption and potential code execution. Outcome: The vulnerable code path is triggered when parsing XML with CDATA sections.

OCCURS_INProblem

A use-after-free vulnerability exists in libxml2 v2.11.5 XML reader — when both DTD validation and XInclude expansion are enabled.

PROVIDED_BYPackage

PROVIDED_BYPackage

PROVIDED_BYPackage

PROVIDED_BYPackage

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata