Re: [xml] Research about vulnerabilities

2019-10-29 Thread Eric Eberhard
nsanely overkill measures. > > Eric > > *From:*xml [mailto:xml-boun...@gnome.org] *On Behalf Of *Webb Scales > *Sent:* Tuesday, October 29, 2019 7:18 AM > *To:* Raphael de Carvalho Muniz > *Cc:* xml@gnome.org > *Subject:* Re: [xml] Research about vulnerabilities > >

Re: [xml] Research about vulnerabilities

2019-10-29 Thread Aleksey Sanin
Raphael de Carvalho Muniz *Cc:* xml@gnome.org *Subject:* Re: [xml] Research about vulnerabilities Raphael, First, the disclaimers:  I'm not an XML maintainer or even a contributor; and, I've only given this a cursory glance. Here are my reactions. First, the routine in question

Re: [xml] Research about vulnerabilities

2019-10-29 Thread Eric Eberhard
insanely overkill measures. Eric From: xml [mailto:xml-boun...@gnome.org] On Behalf Of Webb Scales Sent: Tuesday, October 29, 2019 7:18 AM To: Raphael de Carvalho Muniz Cc: xml@gnome.org Subject: Re: [xml] Research about vulnerabilities Raphael, First, the disclaimers: I'm not a

Re: [xml] Research about vulnerabilities

2019-10-29 Thread Webb Scales
Raphael, First, the disclaimers:  I'm not an XML maintainer or even a contributor; and, I've only given this a cursory glance. Here are my reactions. First, the routine in question is declared to be of module static scope.  I believe that this means that any exploitation of it would have to

Re: [xml] Research about vulnerabilities

2019-10-29 Thread Nick Wellnhofer
On 29/10/2019 14:30, Raphael de Carvalho Muniz wrote: I found in the commit history of Libxml2 (commit 9acef28) the presence of the following code snippet in the libxml.c file (Lines 1,597 - 1,612). More specifically python/libxml.c which is part of the Python bindings. I believe that this co