--- Begin Message ---
Package: release.debian.org
Severity: normal
Tags: bookworm
X-Debbugs-Cc: [email protected],
[email protected], [email protected], [email protected],
[email protected], [email protected]
Control: affects -1 + src:libxml-libxml-perl
User: [email protected]
Usertags: pu
Hi,
[ Reason ]
libxml-libxml-perl is prone to CVE-2026-8177, #1136300, it is not
severe enough to warrant a security advisory.
[ Impact ]
Remains open to CVE-2026-8177
[ Tests ]
Extensive test suite and in addition done a debusine upload as per
https://debusine.debian.net/debian/developers/work-request/896109/ .
[ Risks ]
Patch taken upstream. Fix exposed for roughly a month in unstable (and
migrated to testing).
[ Checklist ]
[x] *all* changes are documented in the d/changelog
[x] I reviewed all changes and I approve them
[x] attach debdiff against the package in (old)stable
[x] the issue is verified as fixed in unstable
[ Changes ]
Fix issue by replacing domParseChar with xmlValidateName to prevent
OOB UTF-8 read.
[ Other info ]
None.
Regards,
Salvatore
diff -Nru libxml-libxml-perl-2.0207+dfsg+really+2.0134/debian/changelog
libxml-libxml-perl-2.0207+dfsg+really+2.0134/debian/changelog
--- libxml-libxml-perl-2.0207+dfsg+really+2.0134/debian/changelog
2022-02-11 19:29:49.000000000 +0000
+++ libxml-libxml-perl-2.0207+dfsg+really+2.0134/debian/changelog
2026-06-27 11:41:54.000000000 +0000
@@ -1,3 +1,11 @@
+libxml-libxml-perl (2.0207+dfsg+really+2.0134-1+deb12u1) bookworm;
urgency=medium
+
+ * Team upload.
+ * fix: replace domParseChar with xmlValidateName to prevent OOB UTF-8 read
+ (CVE-2026-8177) (Closes: #1136300)
+
+ -- Salvatore Bonaccorso <[email protected]> Sat, 27 Jun 2026 13:41:54 +0200
+
libxml-libxml-perl (2.0207+dfsg+really+2.0134-1) unstable; urgency=medium
* Team upload
diff -Nru
libxml-libxml-perl-2.0207+dfsg+really+2.0134/debian/patches/fix-replace-domParseChar-with-xmlValidateName-to-pre.patch
libxml-libxml-perl-2.0207+dfsg+really+2.0134/debian/patches/fix-replace-domParseChar-with-xmlValidateName-to-pre.patch
---
libxml-libxml-perl-2.0207+dfsg+really+2.0134/debian/patches/fix-replace-domParseChar-with-xmlValidateName-to-pre.patch
1970-01-01 00:00:00.000000000 +0000
+++
libxml-libxml-perl-2.0207+dfsg+really+2.0134/debian/patches/fix-replace-domParseChar-with-xmlValidateName-to-pre.patch
2026-06-27 11:41:54.000000000 +0000
@@ -0,0 +1,327 @@
+From: Toddr Bot <[email protected]>
+Date: Tue, 19 May 2026 19:32:08 +0000
+Subject: fix: replace domParseChar with xmlValidateName to prevent OOB UTF-8
+ read
+Origin:
https://github.com/cpan-authors/XML-LibXML/commit/059abf5f9336e2213794b5b545c707394cca3ac7
+Bug-Debian: https://bugs.debian.org/1136300
+Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2026-8177
+
+domParseChar() read continuation bytes for multi-byte UTF-8 sequences without
+validating they exist or have required 10xxxxxx form. Truncated sequences like
+"a\xF0" caused heap reads past NUL terminator. Replace with libxml2's
+xmlValidateName(), which correctly handles all UTF-8 edge cases.
+
+Adds 65 regression tests covering truncation points, invalid continuations, and
+5 affected DOM entry points (createElement, createAttribute, setNodeName, etc).
+
+Fixes https://github.com/cpan-authors/XML-LibXML/issues/146
+---
+ .gitignore | 1 +
+ LibXML.xs | 33 +------------
+ MANIFEST | 1 +
+ dom.c | 88 ---------------------------------
+ dom.h | 32 ------------
+ t/48_security_oob_utf8_gh146.t | 90 ++++++++++++++++++++++++++++++++++
+ 6 files changed, 94 insertions(+), 151 deletions(-)
+ create mode 100644 t/48_security_oob_utf8_gh146.t
+
+diff --git a/LibXML.xs b/LibXML.xs
+index df23bc7d292e..6f18e89c83e8 100644
+--- a/LibXML.xs
++++ b/LibXML.xs
+@@ -1025,40 +1025,11 @@ LibXML_cleanup_parser() {
+ int
+ LibXML_test_node_name( xmlChar * name )
+ {
+- xmlChar * cur = name;
+- int tc = 0;
+- int len = 0;
+-
+- if ( cur == NULL || *cur == 0 ) {
+- /* warn("name is empty" ); */
+- return(0);
+- }
+-
+- tc = domParseChar( cur, &len );
+-
+- if ( !( IS_LETTER( tc ) || (tc == '_') || (tc == ':')) ) {
+- /* warn( "is not a letter\n" ); */
++ if ( name == NULL || *name == 0 ) {
+ return(0);
+ }
+
+- tc = 0;
+- cur += len;
+-
+- while (*cur != 0 ) {
+- tc = domParseChar( cur, &len );
+-
+- if (!(IS_LETTER(tc) || IS_DIGIT(tc) || (tc == '_') ||
+- (tc == '-') || (tc == ':') || (tc == '.') ||
+- IS_COMBINING(tc) || IS_EXTENDER(tc)) ) {
+- /* warn( "is not a letter\n" ); */
+- return(0);
+- }
+- tc = 0;
+- cur += len;
+- }
+-
+- /* warn("name is ok"); */
+- return(1);
++ return xmlValidateName( name, 0 ) == 0;
+ }
+
+ /* Assumes that the node has a proxy. */
+diff --git a/MANIFEST b/MANIFEST
+index 55e093298936..9427babae6fe 100644
+--- a/MANIFEST
++++ b/MANIFEST
+@@ -170,6 +170,7 @@ t/48_replaceNode_DTD_nodes_rT_80521.t
+ t/48_rt123379_setNamespace.t
+ t/48_rt55000.t
+ t/48_rt93429_recover_2_in_html_parsing.t
++t/48_security_oob_utf8_gh146.t
+ t/48importing_nodes_IDs_rt_69520.t
+ t/49_load_html.t
+ t/49callbacks_returning_undef.t
+diff --git a/dom.c b/dom.c
+index 94518b0aea29..a93cce30d940 100644
+--- a/dom.c
++++ b/dom.c
+@@ -237,94 +237,6 @@ domReconcileNs(xmlNodePtr tree)
+ xmlFreeNsList(unused);
+ }
+
+-/**
+- * NAME domParseChar
+- * TYPE function
+- * SYNOPSIS
+- * int utf8char = domParseChar( curchar, &len );
+- *
+- * The current char value, if using UTF-8 this may actually span
+- * multiple bytes in the given string. This function parses an utf8
+- * character from a string into a UTF8 character (an integer). It uses
+- * a slightly modified version of libxml2's character parser. libxml2
+- * itself does not provide any function to parse characters dircetly
+- * from a string and test if they are valid utf8 characters.
+- *
+- * XML::LibXML uses this function rather than perls native UTF8
+- * support for two reasons:
+- * 1) perls UTF8 handling functions often lead to encoding errors,
+- * which partly comes, that they are badly documented.
+- * 2) not all perl versions XML::LibXML intends to run with have native
+- * UTF8 support.
+- *
+- * domParseChar() allows to use the very same code with all versions
+- * of perl :)
+- *
+- * Returns the current char value and its length
+- *
+- * NOTE: If the character passed to this function is not a UTF
+- * character, the return value will be 0 and the length of the
+- * character is -1!
+- */
+-int
+-domParseChar( xmlChar *cur, int *len )
+-{
+- unsigned char c;
+- unsigned int val;
+-
+- /*
+- * We are supposed to handle UTF8, check it's valid
+- * From rfc2044: encoding of the Unicode values on UTF-8:
+- *
+- * UCS-4 range (hex.) UTF-8 octet sequence (binary)
+- * 0000 0000-0000 007F 0xxxxxxx
+- * 0000 0080-0000 07FF 110xxxxx 10xxxxxx
+- * 0000 0800-0000 FFFF 1110xxxx 10xxxxxx 10xxxxxx
+- *
+- * Check for the 0x110000 limit too
+- */
+-
+- if ( cur == NULL || *cur == 0 ) {
+- *len = 0;
+- return(0);
+- }
+-
+- c = *cur;
+- if ( c & 0x80 ) {
+- if ((c & 0xe0) == 0xe0) {
+- if ((c & 0xf0) == 0xf0) {
+- /* 4-byte code */
+- *len = 4;
+- val = (cur[0] & 0x7) << 18;
+- val |= (cur[1] & 0x3f) << 12;
+- val |= (cur[2] & 0x3f) << 6;
+- val |= cur[3] & 0x3f;
+- } else {
+- /* 3-byte code */
+- *len = 3;
+- val = (cur[0] & 0xf) << 12;
+- val |= (cur[1] & 0x3f) << 6;
+- val |= cur[2] & 0x3f;
+- }
+- } else {
+- /* 2-byte code */
+- *len = 2;
+- val = (cur[0] & 0x1f) << 6;
+- val |= cur[1] & 0x3f;
+- }
+- if ( !IS_CHAR(val) ) {
+- *len = -1;
+- return(0);
+- }
+- return(val);
+- }
+- else {
+- /* 1-byte code */
+- *len = 1;
+- return((int)c);
+- }
+-}
+-
+ /**
+ * Name: domReadWellBalancedString
+ * Synopsis: xmlNodePtr domReadWellBalancedString( xmlDocPtr doc, xmlChar
*string )
+diff --git a/dom.h b/dom.h
+index 428b685e1e7a..32936ee3ab3a 100644
+--- a/dom.h
++++ b/dom.h
+@@ -53,38 +53,6 @@ extern "C" {
+ void
+ domReconcileNs(xmlNodePtr tree);
+
+-/**
+- * NAME domParseChar
+- * TYPE function
+- * SYNOPSIS
+- * int utf8char = domParseChar( curchar, &len );
+- *
+- * The current char value, if using UTF-8 this may actually span
+- * multiple bytes in the given string. This function parses an utf8
+- * character from a string into a UTF8 character (an integer). It uses
+- * a slightly modified version of libxml2's character parser. libxml2
+- * itself does not provide any function to parse characters dircetly
+- * from a string and test if they are valid utf8 characters.
+- *
+- * XML::LibXML uses this function rather than perls native UTF8
+- * support for two reasons:
+- * 1) perls UTF8 handling functions often lead to encoding errors,
+- * which partly comes, that they are badly documented.
+- * 2) not all perl versions XML::LibXML intends to run with have native
+- * UTF8 support.
+- *
+- * domParseChar() allows to use the very same code with all versions
+- * of perl :)
+- *
+- * Returns the current char value and its length
+- *
+- * NOTE: If the character passed to this function is not a UTF
+- * character, the return value will be 0 and the length of the
+- * character is -1!
+- */
+-int
+-domParseChar( xmlChar *characters, int *len );
+-
+ xmlNodePtr
+ domReadWellBalancedString( xmlDocPtr doc, xmlChar* string, int repair );
+
+diff --git a/t/48_security_oob_utf8_gh146.t b/t/48_security_oob_utf8_gh146.t
+new file mode 100644
+index 000000000000..74fb6d45697d
+--- /dev/null
++++ b/t/48_security_oob_utf8_gh146.t
+@@ -0,0 +1,90 @@
++# Security regression test for GitHub issue #146:
++# Out-of-bounds heap read via hand-rolled UTF-8 walker on truncated sequences.
++#
++# The original domParseChar() read continuation bytes for multi-byte UTF-8
++# sequences without verifying they exist or are valid. A truncated sequence
++# (e.g., "a\xF0") caused reads past the NUL terminator into uninitialized
++# heap memory. This affects all DOM methods that validate node names via
++# LibXML_test_node_name(): createElement, createAttribute, setNodeName,
++# createElementNS, createAttributeNS, etc.
++#
++# Impact: denial of service (crash on unmapped memory) and potential
++# information disclosure (reading adjacent heap allocations).
++#
++# Fixed by replacing the hand-rolled UTF-8 walker (domParseChar) with
++# libxml2's own xmlValidateName(), which correctly handles all UTF-8
++# edge cases.
++#
++# NOTE: This test verifies that malformed UTF-8 does not crash the process
++# (the actual security issue). Whether a given sequence is rejected depends
++# on the linked libxml2 version — older 2.9.x builds may accept some
++# sequences that newer versions reject.
++
++use strict;
++use warnings;
++
++use Test::More;
++use XML::LibXML;
++
++# Truncated UTF-8 sequences that previously caused OOB heap reads.
++# Each entry: [ bytes, description ]
++my @truncated_sequences = (
++ [ "a\xC0", "truncated 2-byte (leader only)" ],
++ [ "a\xC2", "truncated 2-byte (valid leader, missing
continuation)" ],
++ [ "a\xE0", "truncated 3-byte (leader only)" ],
++ [ "a\xE0\x80", "truncated 3-byte (leader + 1 continuation)" ],
++ [ "a\xF0", "truncated 4-byte (leader only)" ],
++ [ "a\xF0\x80", "truncated 4-byte (leader + 1 continuation)" ],
++ [ "a\xF0\x80\x80", "truncated 4-byte (leader + 2 continuations)" ],
++);
++
++# Invalid continuation bytes — the leader is valid but the continuations
++# are not 10xxxxxx.
++my @invalid_continuations = (
++ [ "a\xC2\x41", "2-byte with ASCII continuation" ],
++ [ "a\xE0\x41\x80", "3-byte with ASCII in first continuation" ],
++ [ "a\xE0\x80\x41", "3-byte with ASCII in second continuation" ],
++ [ "a\xF0\x41\x80\x80", "4-byte with ASCII in first continuation" ],
++ [ "a\xF0\x80\x41\x80", "4-byte with ASCII in second continuation" ],
++ [ "a\xF0\x80\x80\x41", "4-byte with ASCII in third continuation" ],
++);
++
++my @all_bad = (@truncated_sequences, @invalid_continuations);
++
++my @methods = qw( createElement setNodeName createElementNS
++ createAttribute createAttributeNS );
++
++# TEST:$bad_count=13
++# TEST:$method_count=5
++plan tests => scalar(@all_bad) * scalar(@methods);
++
++my $doc = XML::LibXML::Document->new();
++my $nsURI = "http://example.com/ns";;
++
++for my $case (@all_bad) {
++ my ($bytes, $desc) = @$case;
++
++ for my $method (@methods) {
++ eval {
++ if ($method eq 'createElement') {
++ $doc->createElement($bytes);
++ }
++ elsif ($method eq 'setNodeName') {
++ my $node = $doc->createElement("tmp");
++ $node->setNodeName($bytes);
++ }
++ elsif ($method eq 'createElementNS') {
++ $doc->createElementNS($nsURI, $bytes);
++ }
++ elsif ($method eq 'createAttribute') {
++ $doc->createAttribute($bytes, "value");
++ }
++ elsif ($method eq 'createAttributeNS') {
++ $doc->createAttributeNS($nsURI, $bytes, "value");
++ }
++ };
++
++ # TEST*$bad_count*$method_count
++ pass("$method survives $desc without crashing");
++ }
++}
+--
+2.53.0
+
diff -Nru libxml-libxml-perl-2.0207+dfsg+really+2.0134/debian/patches/series
libxml-libxml-perl-2.0207+dfsg+really+2.0134/debian/patches/series
--- libxml-libxml-perl-2.0207+dfsg+really+2.0134/debian/patches/series
2022-02-11 19:08:51.000000000 +0000
+++ libxml-libxml-perl-2.0207+dfsg+really+2.0134/debian/patches/series
2026-06-27 11:41:54.000000000 +0000
@@ -1,3 +1,4 @@
fail-build-no-libxml2.patch
disable_runtime-version_warning.patch
test_against_runtime-version.patch
+fix-replace-domParseChar-with-xmlValidateName-to-pre.patch
--- End Message ---
