From nobody Tue Jul 14 21:21:50 2026 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) client-ip=38.145.34.151; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=reject dis=none) header.from=lists.libvirt.org ARC-Seal: i=1; a=rsa-sha256; t=1784043686; cv=none; d=zohomail.com; s=zohoarc; b=NTmmzXEvRv3CcMfXFVKzvOwmE+l3VelIl3dzUSR228S0I3/elGYGKTV2vkdGB5zeqENd0ptgEwer/b20qmpDcZdSL6znFnA/9xV9yGiFR20CJqVjNUwKfnFbh9MiF3iLnbfEy79Yvkns4g+hB5T5ojvv30exE1TeJb9UW2f1V4I= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1784043686; h=Content-Type:Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Reply-To:Reply-To:Subject:Subject:To:To:Message-Id; bh=JgZbsJ73Irrr43yp2dhV2Uo+Qv7eq+Z3YR5wX6TWXeM=; b=lQVKoFApe6UH3klRjUE+1zR/gokA1s2EgCU93IXQbVoJ6BSUoT0JeHDPEZMA8VzQiJMLlSKV7aCXcYuaTv9Q7EAUJ0ntcRs6eZ2bzWRvVdRNXtP5NjDu/F2gHEEXJ1Z/RS2NmAJoIJ6jtyK9IyKg+BhEmEE9p5OTSAw6Pq/hdwE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of lists.libvirt.org designates 38.145.34.151 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=reject dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [38.145.34.151]) by mx.zohomail.com with SMTPS id 1784043685990368.8628236652843; Tue, 14 Jul 2026 08:41:25 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 639EF41DAD; Tue, 14 Jul 2026 11:41:24 -0400 (EDT) Received: from [172.19.199.10] (unknown [10.16.107.18]) by lists.libvirt.org (Postfix) with ESMTP id 1ACA841BFA; Tue, 14 Jul 2026 11:40:28 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id AC7CD41BC2; Tue, 14 Jul 2026 11:40:19 -0400 (EDT) Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 7808841AFC for ; Tue, 14 Jul 2026 11:40:18 -0400 (EDT) Received: from mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (ec2-54-186-198-63.us-west-2.compute.amazonaws.com [54.186.198.63]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-599-fPjkHZhBNAGxKf76_bbg8Q-1; Tue, 14 Jul 2026 11:40:13 -0400 Received: from mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com [10.30.177.4]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by mx-prod-mc-03.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTPS id 28C20195604E; Tue, 14 Jul 2026 15:40:12 +0000 (UTC) Received: from berrange.com (unknown [10.44.33.163]) by mx-prod-int-01.mail-002.prod.us-west-2.aws.redhat.com (Postfix) with ESMTP id A6DB83000232; Tue, 14 Jul 2026 15:40:10 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=0.6 required=5.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,MAILING_LIST_MULTI,RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2, RCVD_IN_SBL_CSS,SPF_HELO_PASS autolearn=no autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1784043617; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=JgZbsJ73Irrr43yp2dhV2Uo+Qv7eq+Z3YR5wX6TWXeM=; b=YTJNBVL/t+kwhAiAeQpdKx06Lu4jqr9H+FGPdF2iyxamO9BppNeR6bacwlAzS0+9Ac2o91 ezjCIJnxWvc2AmEcvcLf74RFUEG1RfFrWuT57uAAmI/iJRPAF/xkc6r9DcNhhrHq5zF9MO jlYgieGWuuqX7plVoRMFUmw1LuHHih0= X-MC-Unique: fPjkHZhBNAGxKf76_bbg8Q-1 X-Mimecast-MFC-AGG-ID: fPjkHZhBNAGxKf76_bbg8Q_1784043612 To: devel@lists.libvirt.org Subject: [PATCH] src: fix crash searching for XML context string on errors Date: Tue, 14 Jul 2026 16:40:08 +0100 Message-ID: <20260714154008.826591-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.4.1 on 10.30.177.4 X-Mimecast-Spam-Score: 0 X-Mimecast-MFC-PROC-ID: BiISBtirCopjJzC2jIj2fuWUmanGMOi7C0Onjcx3uCE_1784043612 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-ID-Hash: 4QXGP64PLGQA36YA4S4JTLLX3YUC47UE X-Message-ID-Hash: 4QXGP64PLGQA36YA4S4JTLLX3YUC47UE X-MailFrom: berrange@redhat.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: Rx X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: From: =?utf-8?q?Daniel_P=2E_Berrang=C3=A9_via_Devel?= Reply-To: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1784043689792158500 From: Daniel P. Berrang=C3=A9 When we have an XML parse error, libxml2 invokes a callback that receives pointers to the start of the document being parsed and the location where the error was triggered. In the case of a document that contains 100's of empty lines (ie a sequence of newlines), at some point libxml2 will advance the base pointer discarding the useful context. Thus when catchXMLError then searches backwards to discard empty lines and look for the context element, it will eventually get to the start of the string. When this happens the virBuffer that holds the context string ends up empty and then catchXMLError will dereference a NULL pointer. In almost all cases, the APIs which accept XML documents from the user are behind the primary read-write socket, however, the CPU baseline API is exposed to the read-only socket. Thus an unprivileged user can trigger a denial of service by crashing the libvirt daemons with a malicious XML document. Check for this empty string condition and skip inclusion of the XML document context in the error message. Fixes: CVE-2026-61478 Reported-by: Rx Signed-off-by: Daniel P. Berrang=C3=A9 --- src/util/virxml.c | 46 +++++++++++++++++++++++++++++++--------------- 1 file changed, 31 insertions(+), 15 deletions(-) diff --git a/src/util/virxml.c b/src/util/virxml.c index beb5301378..8349115633 100644 --- a/src/util/virxml.c +++ b/src/util/virxml.c @@ -1173,7 +1173,8 @@ catchXMLError(void *ctx, const char *msg G_GNUC_UNUSE= D, ...) contextstr =3D virBufferContentAndReset(&buf); =20 /* (leave buffer space for pointer + line terminator) */ - for (n =3D 0; (nline, - lastError->message, - contextstr, - pointerstr); + if (contextstr) { + if (filename) { + virGenericReportError(domcode, VIR_ERR_XML_DETAIL, + _("%1$s:%2$d: %3$s%4$s\n%5$s"), + filename, + lastError->line, + lastError->message, + contextstr, + pointerstr); + } else { + virGenericReportError(domcode, VIR_ERR_XML_DETAIL, + _("at line %1$d: %2$s%3$s\n%4$s"), + lastError->line, + lastError->message, + contextstr, + pointerstr); + } } else { - virGenericReportError(domcode, VIR_ERR_XML_DETAIL, - _("at line %1$d: %2$s%3$s\n%4$s"), - lastError->line, - lastError->message, - contextstr, - pointerstr); + if (filename) { + virGenericReportError(domcode, VIR_ERR_XML_DETAIL, + _("%1$s:%2$d: %3$s"), + filename, + lastError->line, + lastError->message); + } else { + virGenericReportError(domcode, VIR_ERR_XML_DETAIL, + _("at line %1$d: %2$s"), + lastError->line, + lastError->message); + } } } =20 --=20 2.55.0