Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
gnome/libxml2
master @ 13a3df9
21
Fixes
50
CVEs
CRITICAL
Peak severity
26.3%
Coverage
Highlights
Memory Corruption: 4 prior fixes. Scrutinize any change in this area.
tree.c: most-fixed (3 issues). Treat as high-risk during review.
17 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Type Confusion: Type confusion occurs in the canonicalization module when parent nodes are assumed to be XML_ELEMENT_NODE types without validation before accessing their properties or namespaces, potentially leading to arbitrary memory access or crashes.
Use-After-Free: Insecure node lifecycles during tree modification, such as failing to unlink nodes before freeing them or leaving stale pointer references in the document ID tables, regularly introduce use-after-free bugs.
Integer Overflow: Arithmetic overflows during parser array capacity planning and buffer expansion lead directly to out-of-bounds heap writes, requiring unified APIs like xmlGrowArray with safe bounds checking to remediate.