Repository navigation
[CVE-2026-56131] lib: Protect XML_ResumeParser from being called from a handler - #1267
Conversation
The handler-reentrancy guards from CVE-2026-50219 cover XML_Parse, XML_ParseBuffer, XML_GetBuffer, XML_ParserFree and XML_ParserReset but not XML_ResumeParser, which drives the parser through callProcessor in the same way.
|
Is there an ETA for this fix, and presumably a consequential 2.8.2 release, please? |
@simoneves no ETA for this or 2.8.2, I'm overloaded, please be patient. |
|
Understood. Just saw your front-page message. Sorry. |
hartwork
left a comment
hartwork
left a comment
There was a problem hiding this comment.
@netliomax25-code I confirm, very nice finding and pull request! I'll request a CVE for vulnerability "incomplete fix to CVE-2026-50219" in a minute and merge once we got a CVE.
hartwork
changed the title
hartwork
changed the title
XML_ResumeParser from being called from a handler
hartwork
changed the title
XML_ResumeParser from being called from a handlerXML_ResumeParser from being called from a handler
|
Update: CVE requested from Mitre just now. |
|
Sounds good, thanks for handling the CVE side. The branch still applies cleanly on master, so nothing pending from my end. Happy to adjust anything before merge if you want it shaped differently. |
I can assist, and help out if needed, would love to. |
|
@Phlegmelm thanks for your offer to help! Analysis, code review and requesting a CVE from Mitre are all done by now. So only receiving the CVE, putting it in the pull request subject, and merging the pull request are left to do at this point, it's basically already done. |
hartwork
changed the title
XML_ResumeParser from being called from a handlerXML_ResumeParser from being called from a handler
|
CVE-2026-56131 has been assigned by now. |
isCalledFromInsideHandlercheck toXML_Parse,XML_ParseBuffer,XML_GetBuffer,XML_ParserFreeandXML_ParserReset, butXML_ResumeParserwas left out.XML_ResumeParserdrives the parser throughcallProcessorjust likeXML_Parse, so a handler that first suspends withXML_StopParser(parser, XML_TRUE)(which is allowed from handlers) and then callsXML_ResumeParser(parser)re-enters the parser while the outer parse is still on the stack, the same memory-corruption path the other guards close.isCalledFromInsideHandlercheck at the top ofXML_ResumeParser, matchingXML_ParseBuffer.Validation: a regression test suspends from a character data handler and asserts the in-handler resume is rejected. It fails before the change (the resume returns a non-error status and re-enters the parser) and passes after. Full suite green afterwards (Checks: 4812, Failed: 0).