diff -pruN 2.14.4+dfsg-0exp1/CMakeLists.txt 2.14.5+dfsg-0exp1/CMakeLists.txt --- 2.14.4+dfsg-0exp1/CMakeLists.txt 2025-06-16 17:03:53.000000000 +0000 +++ 2.14.5+dfsg-0exp1/CMakeLists.txt 2025-07-15 13:08:05.000000000 +0000 @@ -354,7 +354,7 @@ if(WIN32) endif() if(LIBXML2_WITH_ICONV) - target_link_libraries(LibXml2 PUBLIC Iconv::Iconv) + target_link_libraries(LibXml2 PRIVATE Iconv::Iconv) if(NOT Iconv_IS_BUILT_IN) set(ICONV_LIBS "-liconv") endif() diff -pruN 2.14.4+dfsg-0exp1/HTMLparser.c 2.14.5+dfsg-0exp1/HTMLparser.c --- 2.14.4+dfsg-0exp1/HTMLparser.c 2025-06-16 17:03:53.000000000 +0000 +++ 2.14.5+dfsg-0exp1/HTMLparser.c 2025-07-15 13:08:05.000000000 +0000 @@ -438,7 +438,7 @@ invalid: /* Only report the first error */ if ((ctxt->input->flags & XML_INPUT_ENCODING_ERROR) == 0) { htmlParseErr(ctxt, XML_ERR_INVALID_ENCODING, - "Invalid bytes in character encoding", NULL, NULL); + "Invalid bytes in character encoding\n", NULL, NULL); ctxt->input->flags |= XML_INPUT_ENCODING_ERROR; } @@ -5739,6 +5739,11 @@ htmlCtxtSetOptionsInternal(xmlParserCtxt ctxt->keepBlanks = (options & HTML_PARSE_NOBLANKS) ? 0 : 1; /* + * Recover from character encoding errors + */ + ctxt->recovery = 1; + + /* * Changing SAX callbacks is a bad idea. This should be fixed. */ if (options & HTML_PARSE_NOBLANKS) { diff -pruN 2.14.4+dfsg-0exp1/NEWS 2.14.5+dfsg-0exp1/NEWS --- 2.14.4+dfsg-0exp1/NEWS 2025-06-16 17:03:53.000000000 +0000 +++ 2.14.5+dfsg-0exp1/NEWS 2025-07-15 13:08:05.000000000 +0000 @@ -1,5 +1,31 @@ NEWS file for libxml2 +v2.14.5: Jul 10 2025 + +### Regressions + +- html: Don't abort on encoding errors +- parser: Fix handling of invalid char refs in recovery mode +- xmllint: Print document even in case of XInclude errors +- xmllint: Fix --xinclude --path + +### Security + +- schematron: Fix memory safety issues in xmlSchematronReportOutput +- Schematron: Fix null pointer dereference leading to DoS (Michael Mann) +- Fix potential buffer overflows of interactive shell (Michael Mann) + +### Improvements + +- parser: Fix xmlCtxtIsStopped + +### Build systems and portability + +- schemas: Fix compilation with pre-C99 MSVC +- cmake: Add missing endif() in libxml2-config.cmake.in +- Fix CMake iconv handling after change to private dependency (Markus Rickert) + + v2.14.4: Jun 16 2025 ### Regressions diff -pruN 2.14.4+dfsg-0exp1/VERSION 2.14.5+dfsg-0exp1/VERSION --- 2.14.4+dfsg-0exp1/VERSION 2025-06-16 17:03:53.000000000 +0000 +++ 2.14.5+dfsg-0exp1/VERSION 2025-07-15 13:08:05.000000000 +0000 @@ -1 +1 @@ -2.14.4 +2.14.5 diff -pruN 2.14.4+dfsg-0exp1/configure 2.14.5+dfsg-0exp1/configure --- 2.14.4+dfsg-0exp1/configure 2025-06-16 17:03:58.000000000 +0000 +++ 2.14.5+dfsg-0exp1/configure 2025-07-15 13:08:09.000000000 +0000 @@ -1,6 +1,6 @@ #! /bin/sh # Guess values for system-dependent variables and create Makefiles. -# Generated by GNU Autoconf 2.71 for libxml2 2.14.4. +# Generated by GNU Autoconf 2.71 for libxml2 2.14.5. # # # Copyright (C) 1992-1996, 1998-2017, 2020-2021 Free Software Foundation, @@ -618,8 +618,8 @@ MAKEFLAGS= # Identity of this package. PACKAGE_NAME='libxml2' PACKAGE_TARNAME='libxml2' -PACKAGE_VERSION='2.14.4' -PACKAGE_STRING='libxml2 2.14.4' +PACKAGE_VERSION='2.14.5' +PACKAGE_STRING='libxml2 2.14.5' PACKAGE_BUGREPORT='' PACKAGE_URL='' @@ -1535,7 +1535,7 @@ if test "$ac_init_help" = "long"; then # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF -\`configure' configures libxml2 2.14.4 to adapt to many kinds of systems. +\`configure' configures libxml2 2.14.5 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... @@ -1606,7 +1606,7 @@ fi if test -n "$ac_init_help"; then case $ac_init_help in - short | recursive ) echo "Configuration of libxml2 2.14.4:";; + short | recursive ) echo "Configuration of libxml2 2.14.5:";; esac cat <<\_ACEOF @@ -1779,7 +1779,7 @@ fi test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF -libxml2 configure 2.14.4 +libxml2 configure 2.14.5 generated by GNU Autoconf 2.71 Copyright (C) 2021 Free Software Foundation, Inc. @@ -2049,7 +2049,7 @@ cat >config.log <<_ACEOF This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. -It was created by libxml2 $as_me 2.14.4, which was +It was created by libxml2 $as_me 2.14.5, which was generated by GNU Autoconf 2.71. Invocation command line was $ $0$ac_configure_args_raw @@ -2886,7 +2886,7 @@ case $host_os in *\ *) host_os=`echo "$h -LIBXML_VERSION=2.14.4 +LIBXML_VERSION=2.14.5 LIBXML_MAJOR_VERSION=`echo $LIBXML_VERSION | cut -d . -f 1` LIBXML_MINOR_VERSION=`echo $LIBXML_VERSION | cut -d . -f 2` LIBXML_MICRO_VERSION=`echo $LIBXML_VERSION | cut -d . -f 3` @@ -3430,7 +3430,7 @@ fi # Define the identity of the package. PACKAGE='libxml2' - VERSION='2.14.4' + VERSION='2.14.5' printf "%s\n" "#define PACKAGE \"$PACKAGE\"" >>confdefs.h @@ -16879,7 +16879,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_wri # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" -This file was extended by libxml2 $as_me 2.14.4, which was +This file was extended by libxml2 $as_me 2.14.5, which was generated by GNU Autoconf 2.71. Invocation command line was CONFIG_FILES = $CONFIG_FILES @@ -16947,7 +16947,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config='$ac_cs_config_escaped' ac_cs_version="\\ -libxml2 config.status 2.14.4 +libxml2 config.status 2.14.5 configured by $0, generated by GNU Autoconf 2.71, with options \\"\$ac_cs_config\\" diff -pruN 2.14.4+dfsg-0exp1/debian/changelog 2.14.5+dfsg-0exp1/debian/changelog --- 2.14.4+dfsg-0exp1/debian/changelog 2025-07-05 18:59:44.000000000 +0000 +++ 2.14.5+dfsg-0exp1/debian/changelog 2025-07-19 09:38:53.000000000 +0000 @@ -1,3 +1,10 @@ +libxml2 (2.14.5+dfsg-0exp1) experimental; urgency=medium + + * Non-maintainer upload. + * New upstream release. + + -- Matthias Klose Sat, 19 Jul 2025 11:38:53 +0200 + libxml2 (2.14.4+dfsg-0exp1) experimental; urgency=medium * Non-maintainer upload. diff -pruN 2.14.4+dfsg-0exp1/libxml2-config.cmake.in 2.14.5+dfsg-0exp1/libxml2-config.cmake.in --- 2.14.4+dfsg-0exp1/libxml2-config.cmake.in 2025-06-16 17:03:54.000000000 +0000 +++ 2.14.5+dfsg-0exp1/libxml2-config.cmake.in 2025-07-15 13:08:05.000000000 +0000 @@ -56,7 +56,7 @@ if(NOT LIBXML2_SHARED) if(LIBXML2_WITH_ICONV) find_dependency(Iconv) list(APPEND LIBXML2_LIBRARIES ${Iconv_LIBRARIES}) - list(APPEND LIBXML2_INTERFACE_LINK_LIBRARIES "Iconv::Iconv") + list(APPEND LIBXML2_INTERFACE_LINK_LIBRARIES "\$") if(NOT Iconv_FOUND) set(${CMAKE_FIND_PACKAGE_NAME}_FOUND FALSE) set(${CMAKE_FIND_PACKAGE_NAME}_NOT_FOUND_MESSAGE "Iconv dependency was not found") @@ -119,6 +119,7 @@ if(NOT LIBXML2_SHARED) if(LIBXML2_WITH_HTTP) list(APPEND LIBXML2_LIBRARIES ws2_32) list(APPEND LIBXML2_INTERFACE_LINK_LIBRARIES "\$") + endif() endif() endif() diff -pruN 2.14.4+dfsg-0exp1/parser.c 2.14.5+dfsg-0exp1/parser.c --- 2.14.4+dfsg-0exp1/parser.c 2025-06-16 17:03:54.000000000 +0000 +++ 2.14.5+dfsg-0exp1/parser.c 2025-07-15 13:08:05.000000000 +0000 @@ -2675,14 +2675,13 @@ xmlParseCharRef(xmlParserCtxtPtr ctxt) { xmlFatalErrMsgInt(ctxt, XML_ERR_INVALID_CHAR, "xmlParseCharRef: character reference out of bounds\n", val); - } else if (IS_CHAR(val)) { - return(val); - } else { + val = 0xFFFD; + } else if (!IS_CHAR(val)) { xmlFatalErrMsgInt(ctxt, XML_ERR_INVALID_CHAR, "xmlParseCharRef: invalid xmlChar value %d\n", val); } - return(0); + return(val); } /** diff -pruN 2.14.4+dfsg-0exp1/parserInternals.c 2.14.5+dfsg-0exp1/parserInternals.c --- 2.14.4+dfsg-0exp1/parserInternals.c 2025-06-16 17:03:54.000000000 +0000 +++ 2.14.5+dfsg-0exp1/parserInternals.c 2025-07-15 13:08:05.000000000 +0000 @@ -3327,7 +3327,7 @@ xmlCtxtIsStopped(xmlParserCtxtPtr ctxt) if (ctxt == NULL) return(0); - return(PARSER_STOPPED(ctxt)); + return(ctxt->disableSAX != 0); } #ifdef LIBXML_VALID_ENABLED diff -pruN 2.14.4+dfsg-0exp1/runtest.c 2.14.5+dfsg-0exp1/runtest.c --- 2.14.4+dfsg-0exp1/runtest.c 2025-06-16 17:03:54.000000000 +0000 +++ 2.14.5+dfsg-0exp1/runtest.c 2025-07-15 13:08:05.000000000 +0000 @@ -3999,6 +3999,9 @@ schematronTest(const char *filename, size_t i; char count = 0; + /* Redirect XPath errors */ + xmlSetStructuredErrorFunc(NULL, testStructuredErrorHandler); + pctxt = xmlSchematronNewParserCtxt(filename); schematron = xmlSchematronParse(pctxt); xmlSchematronFreeParserCtxt(pctxt); @@ -4012,8 +4015,8 @@ schematronTest(const char *filename, */ len = strlen(base); if ((len > 499) || (len < 5)) { - xmlSchematronFree(schematron); - return(-1); + ret = -1; + goto done; } len -= 4; /* remove trailing .sct */ memcpy(prefix, base, len); @@ -4053,8 +4056,10 @@ schematronTest(const char *filename, } } globfree(&globbuf); - xmlSchematronFree(schematron); +done: + xmlSchematronFree(schematron); + xmlSetStructuredErrorFunc(NULL, NULL); return(ret); } #endif /* LIBXML_SCHEMATRON_ENABLED */ diff -pruN 2.14.4+dfsg-0exp1/schematron.c 2.14.5+dfsg-0exp1/schematron.c --- 2.14.4+dfsg-0exp1/schematron.c 2025-06-16 17:03:54.000000000 +0000 +++ 2.14.5+dfsg-0exp1/schematron.c 2025-07-15 13:08:05.000000000 +0000 @@ -1413,27 +1413,15 @@ exit: * * ************************************************************************/ -static xmlNodePtr +static xmlXPathObjectPtr xmlSchematronGetNode(xmlSchematronValidCtxtPtr ctxt, xmlNodePtr cur, const xmlChar *xpath) { - xmlNodePtr node = NULL; - xmlXPathObjectPtr ret; - if ((ctxt == NULL) || (cur == NULL) || (xpath == NULL)) return(NULL); ctxt->xctxt->doc = cur->doc; ctxt->xctxt->node = cur; - ret = xmlXPathEval(xpath, ctxt->xctxt); - if (ret == NULL) - return(NULL); - - if ((ret->type == XPATH_NODESET) && - (ret->nodesetval != NULL) && (ret->nodesetval->nodeNr > 0)) - node = ret->nodesetval->nodeTab[0]; - - xmlXPathFreeObject(ret); - return(node); + return(xmlXPathEval(xpath, ctxt->xctxt)); } /** @@ -1479,25 +1467,40 @@ xmlSchematronFormatReport(xmlSchematronV (child->type == XML_CDATA_SECTION_NODE)) ret = xmlStrcat(ret, child->content); else if (IS_SCHEMATRON(child, "name")) { + xmlXPathObject *obj = NULL; xmlChar *path; path = xmlGetNoNsProp(child, BAD_CAST "path"); node = cur; if (path != NULL) { - node = xmlSchematronGetNode(ctxt, cur, path); - if (node == NULL) - node = cur; + obj = xmlSchematronGetNode(ctxt, cur, path); + if ((obj != NULL) && + (obj->type == XPATH_NODESET) && + (obj->nodesetval != NULL) && + (obj->nodesetval->nodeNr > 0)) + node = obj->nodesetval->nodeTab[0]; xmlFree(path); } - if ((node->ns == NULL) || (node->ns->prefix == NULL)) - ret = xmlStrcat(ret, node->name); - else { - ret = xmlStrcat(ret, node->ns->prefix); - ret = xmlStrcat(ret, BAD_CAST ":"); - ret = xmlStrcat(ret, node->name); + switch (node->type) { + case XML_ELEMENT_NODE: + case XML_ATTRIBUTE_NODE: + if ((node->ns == NULL) || (node->ns->prefix == NULL)) + ret = xmlStrcat(ret, node->name); + else { + ret = xmlStrcat(ret, node->ns->prefix); + ret = xmlStrcat(ret, BAD_CAST ":"); + ret = xmlStrcat(ret, node->name); + } + break; + + /* TODO: handle other node types */ + default: + break; } + + xmlXPathFreeObject(obj); } else if (IS_SCHEMATRON(child, "value-of")) { xmlChar *select; xmlXPathObjectPtr eval; @@ -1505,6 +1508,11 @@ xmlSchematronFormatReport(xmlSchematronV select = xmlGetNoNsProp(child, BAD_CAST "select"); comp = xmlXPathCtxtCompile(ctxt->xctxt, select); eval = xmlXPathCompiledEval(comp, ctxt->xctxt); + if (eval == NULL) { + xmlXPathFreeCompExpr(comp); + xmlFree(select); + return ret; + } switch (eval->type) { case XPATH_NODESET: { diff -pruN 2.14.4+dfsg-0exp1/shell.c 2.14.5+dfsg-0exp1/shell.c --- 2.14.4+dfsg-0exp1/shell.c 2025-06-16 17:03:54.000000000 +0000 +++ 2.14.5+dfsg-0exp1/shell.c 2025-07-15 13:08:05.000000000 +0000 @@ -1046,6 +1046,10 @@ xmllintShellPwd(xmllintShellCtxtPtr ctxt return (0); } +#define MAX_PROMPT_SIZE 500 +#define MAX_ARG_SIZE 400 +#define MAX_COMMAND_SIZE 100 + /** * xmllintShellReadline: * @prompt: the prompt value @@ -1057,7 +1061,7 @@ xmllintShellPwd(xmllintShellCtxtPtr ctxt */ static char * xmllintShellReadline(char *prompt) { - char buf[501]; + char buf[MAX_PROMPT_SIZE+1]; char *ret; int len; @@ -1081,9 +1085,9 @@ xmllintShellReadline(char *prompt) { if (prompt != NULL) fprintf(stdout, "%s", prompt); fflush(stdout); - if (!fgets(buf, 500, stdin)) + if (!fgets(buf, MAX_PROMPT_SIZE, stdin)) return(NULL); - buf[500] = 0; + buf[MAX_PROMPT_SIZE] = 0; len = strlen(buf); ret = (char *) malloc(len + 1); if (ret != NULL) { @@ -1105,10 +1109,10 @@ xmllintShellReadline(char *prompt) { void xmllintShell(xmlDocPtr doc, const char *filename, FILE * output) { - char prompt[500] = "/ > "; + char prompt[MAX_PROMPT_SIZE] = "/ > "; char *cmdline = NULL, *cur; - char command[100]; - char arg[400]; + char command[MAX_COMMAND_SIZE]; + char arg[MAX_ARG_SIZE]; int i; xmllintShellCtxtPtr ctxt; #ifdef LIBXML_XPATH_ENABLED @@ -1165,7 +1169,8 @@ xmllintShell(xmlDocPtr doc, const char * cur++; i = 0; while ((*cur != ' ') && (*cur != '\t') && - (*cur != '\n') && (*cur != '\r')) { + (*cur != '\n') && (*cur != '\r') && + (i < (MAX_COMMAND_SIZE - 1))) { if (*cur == 0) break; command[i++] = *cur++; @@ -1180,7 +1185,7 @@ xmllintShell(xmlDocPtr doc, const char * while ((*cur == ' ') || (*cur == '\t')) cur++; i = 0; - while ((*cur != '\n') && (*cur != '\r') && (*cur != 0)) { + while ((*cur != '\n') && (*cur != '\r') && (*cur != 0) && (i < (MAX_ARG_SIZE-1))) { if (*cur == 0) break; arg[i++] = *cur++; diff -pruN 2.14.4+dfsg-0exp1/testparser.c 2.14.5+dfsg-0exp1/testparser.c --- 2.14.4+dfsg-0exp1/testparser.c 2025-06-16 17:03:54.000000000 +0000 +++ 2.14.5+dfsg-0exp1/testparser.c 2025-07-15 13:08:05.000000000 +0000 @@ -182,6 +182,24 @@ testUndeclEntInContent(void) { return err; } +static int +testInvalidCharRecovery(void) { + const char *xml = ""; + xmlDoc *doc; + int err = 0; + + doc = xmlReadDoc(BAD_CAST xml, NULL, NULL, XML_PARSE_RECOVER); + + if (strcmp((char *) doc->children->children->content, "\x10") != 0) { + fprintf(stderr, "Failed to recover from invalid char ref\n"); + err = 1; + } + + xmlFreeDoc(doc); + + return err; +} + #ifdef LIBXML_VALID_ENABLED static void testSwitchDtdExtSubset(void *vctxt, const xmlChar *name ATTRIBUTE_UNUSED, @@ -1250,6 +1268,7 @@ main(void) { err |= testNodeGetContent(); err |= testCFileIO(); err |= testUndeclEntInContent(); + err |= testInvalidCharRecovery(); #ifdef LIBXML_VALID_ENABLED err |= testSwitchDtd(); #endif diff -pruN 2.14.4+dfsg-0exp1/tree.c 2.14.5+dfsg-0exp1/tree.c --- 2.14.4+dfsg-0exp1/tree.c 2025-06-16 17:03:54.000000000 +0000 +++ 2.14.5+dfsg-0exp1/tree.c 2025-07-15 13:08:05.000000000 +0000 @@ -45,6 +45,10 @@ #include "private/memory.h" #include "private/tree.h" +#ifndef SIZE_MAX + #define SIZE_MAX ((size_t) -1) +#endif + /* * Internal variable indicating whether a callback has been registered * for node creation/destruction. This avoids looking up thread-local diff -pruN 2.14.4+dfsg-0exp1/xmllint.c 2.14.5+dfsg-0exp1/xmllint.c --- 2.14.4+dfsg-0exp1/xmllint.c 2025-06-16 17:03:54.000000000 +0000 +++ 2.14.5+dfsg-0exp1/xmllint.c 2025-07-15 13:08:05.000000000 +0000 @@ -2181,13 +2181,30 @@ parseAndPrintFile(xmllintState *lint, co #ifdef LIBXML_XINCLUDE_ENABLED if (lint->xinclude) { + xmlXIncludeCtxt *xinc; + int res; + if ((lint->timing) && (lint->repeat == 1)) { startTimer(lint); } - if (xmlXIncludeProcessFlags(doc, lint->options) < 0) { - lint->progresult = XMLLINT_ERR_UNCLASS; + + xinc = xmlXIncludeNewContext(doc); + if (xinc == NULL) { + lint->progresult = XMLLINT_ERR_MEM; goto done; } + xmlXIncludeSetResourceLoader(xinc, xmllintResourceLoader, lint); + xmlXIncludeSetFlags(xinc, lint->options); + res = xmlXIncludeProcessNode(xinc, (xmlNode *) doc); + xmlXIncludeFreeContext(xinc); + if (res < 0) { + /* + * Return an error but continue to print the document + * to match long-standing behavior. + */ + lint->progresult = XMLLINT_ERR_UNCLASS; + } + if ((lint->timing) && (lint->repeat == 1)) { endTimer(lint, "Xinclude processing"); } diff -pruN 2.14.4+dfsg-0exp1/xmlschemastypes.c 2.14.5+dfsg-0exp1/xmlschemastypes.c --- 2.14.4+dfsg-0exp1/xmlschemastypes.c 2025-06-16 17:03:54.000000000 +0000 +++ 2.14.5+dfsg-0exp1/xmlschemastypes.c 2025-07-15 13:08:05.000000000 +0000 @@ -540,11 +540,13 @@ xmlSchemaInitTypes(void) xmlSchemaPINF = INFINITY; xmlSchemaNINF = -INFINITY; #else - /* MSVC doesn't allow division by zero in constant expressions. */ - double zero = 0.0; - xmlSchemaNAN = 0.0 / zero; - xmlSchemaPINF = 1.0 / zero; - xmlSchemaNINF = -xmlSchemaPINF; + { + /* MSVC doesn't allow division by zero in constant expressions. */ + double zero = 0.0; + xmlSchemaNAN = 0.0 / zero; + xmlSchemaPINF = 1.0 / zero; + xmlSchemaNINF = -xmlSchemaPINF; + } #endif xmlSchemaTypesBank = xmlHashCreate(40);