On Tue, Jul 14, 2026 at 16:40:08 +0100, Daniel P. Berrangé via Devel wrote: > From: Daniel P. Berrangé <[email protected]> > > When we have an XML parse error, libxml2 invokes a callback that > receives pointers to the start of the document being parsed and the > location where the error was triggered. > > In the case of a document that contains 100's of empty lines > (ie a sequence of newlines), at some point libxml2 will advance > the base pointer discarding the useful context. > > Thus when catchXMLError then searches backwards to discard empty > lines and look for the context element, it will eventually get > to the start of the string. When this happens the virBuffer that > holds the context string ends up empty and then catchXMLError will > dereference a NULL pointer. > > In almost all cases, the APIs which accept XML documents from > the user are behind the primary read-write socket, however, the > CPU baseline API is exposed to the read-only socket. Thus an > unprivileged user can trigger a denial of service by crashing > the libvirt daemons with a malicious XML document. > > Check for this empty string condition and skip inclusion of the > XML document context in the error message. > > Fixes: CVE-2026-61478 > Reported-by: Rx <[email protected]> > Signed-off-by: Daniel P. Berrangé <[email protected]> > --- > src/util/virxml.c | 46 +++++++++++++++++++++++++++++++--------------- > 1 file changed, 31 insertions(+), 15 deletions(-)
Reviewed-by: Peter Krempa <[email protected]>
