Source: libxml2
Version: 2.9.2+dfsg1-1
Severity: wishlist
Tags: patch upstream forwarded-upstream
Forwarded: https://bugzilla.gnome.org/show_bug.cgi?id=739574

Hi,

please consider applying the attached patch in subsequent uploads,
at least until upstream has integrated it. It fixes:

• replace several ad-hōc UTF-8 decoders with calls to one that
  does the thing right (validate input string length and encoding,
  and check for minimal encoded values)

• in several places, check the values for being actually ok in
  XML documents, which limits what Unicode codepoints may be used
  ‣ when there was already error handling in place, re-use that
  ‣ otherwise silently drop the characters, to not break any
    existing application

This prevents e.g. a SOAP-WS client written in PHP from sending
invalid XML as SOAP request over the wire for strings containing
e.g. literal backspace characters.

Thanks,
//mirabilos

I'd rather wait for upstream's reaction for a longer time, since
deltas to libxml2 from upstream must be dealt carefully (as said, the
more you read the code then...).

Thanks,
Aron

Hah, I feel *so* vindicated.

http://www.mirbsd.org/~tg/Debs/dists/buster/wtf/Pkgs/libxml2/libxml2_2.9.4+dfsg1-7+b3tarent1.debdiff

I already carried a (different) fix for this issue (and others)
which I prepared during 2013/2014 when working on a project for
a customer that used libxml2 through several abstraction levels,
and when proposing the patches upstream, they didn’t care (they
could not agree which way forward was right and decided to keep
the bad behaviour in the meantime), and in #770836 the packager
wasn’t interested, either.

Maybe it’s time, from a security PoV, to look at my diff again,
figure out which of it is now superceded, if any of the patches
that were applied still need fixing, and which of the bugs were
not yet addressed. I’m not on that project any more, so I can’t
currently justify doing the expenses.

bye,
//mirabilos