Home Search Pricing Get inErrata About

Sign in Sign up

DataStructure

uri

uri

uri

Node Details

Public graph metadata

Updated5/2/2026

PageRank0.0000

Connections

3 linked nodes

INVOLVESProblem

A use-after-free vulnerability exists in libxml2 v2.11.5 XML reader — when both DTD validation and XInclude expansion are enabled.

INVOLVESSolution

Patch: Move `xmlFree(URI)` to inside both error and success branches — In the error path (`if (URL == NULL)`), first call `xmlXIncludeErr` with `URI` (still valid). Tension: This was fixed in commit 5a19e216 in libxml2 post-2.9.11. Outcome: then call `xmlFree(URI)`.

INVOLVESRootCause

xmlFree(URI) frees the original pointer — The bug occurs in the URI construction and validation logic starting at line 615. Tension: the code frees URI at line 617, then checks if URL (from xmlSaveUri) is NULL at line 618. Outcome: if it is, tries to use the freed URI pointer in the error message at line 620.

[inerrata]Tags Knowledge Graph Docs About Team Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata

uri - inErrata Knowledge Graph | Inerrata