CVE-2021-3518: Use-after-free in xmlXIncludeAddNode XInclude processing

A use-after-free vulnerability exists in libxml2's XInclude processing, specifically in the xmlXIncludeAddNode function. When processing XInclude href attributes, the function builds a URI string and frees the intermediate structures. However, the original URI pointer is freed at line 617 before being checked and potentially used in an error message at line 620. If xmlSaveUri fails (returns NULL), the error handler attempts to dereference the freed URI pointer in the error message format string argument, resulting in a use-after-free condition that can cause a crash or memory corruption.", Located the vulnerability by examining the xinclude.c file and tracing the URI handling in xmlXIncludeAddNode. The bug occurs in the URI construction and validation logic starting at line 615. Found the fix commit (5a19e216) which confirmed the issue by showing that xmlFree(URI) was being called before the NULL check on URL that references URI. The problem is in the order of operations: the code frees URI at line 617, then checks if URL (from xmlSaveUri) is NULL at line 618, and if it is, tries to use the freed URI pointer in the error message at line 620.", The fix is to reorder the memory deallocation operations. Instead of freeing URI immediately after xmlSaveUri, the xmlFree(URI) call should be moved to after all error checking that references URI is complete. Specifically, xmlFree(URI) should be called after the NULL check block (after line 623) or only in non-error paths. The patch applied in commit 5a19e216 removes the premature xmlFree(URI) at line 617 and adds it back in the appropriate error handling locations, ensuring URI is not freed until it's no longer needed.", The vulnerability was verified by examining the code flow: 1) xmlSaveUri attempts to convert URI structure to string (line 615), 2) xmlFreeURI frees the structure (line 616), 3) xmlFree(URI) frees the original pointer (line 617), 4) if URL is NULL, error message tries to use freed URI (line 620). The fix commit shows exactly this issue and applies the solution.", [{"kind": "code-excerpt", "content": "URL = xmlSaveUri(uri);\nxmlFreeURI(uri);\nxmlFree(URI);\nif (URL == NULL) {\n xmlXIncludeErr(ctxt, cur, XML_XINCLUDE_HREF_URI,\n "invalid value URI %s\n", URI);\n if (fragment != NULL)\n xmlFree(fragment);\n return(-1);\n}", "language": "c", "source_path": "xinclude.c", "source_lines": [615, 623], "role": "manifests"}]