A buffer overflow was discovered in libxml2. The function xmlSnprintfElementContent in valid.c is supposed to recursively dump the element content definition into a char buffer 'buf' of size 'size'. The variable len is assigned strlen(buf). If the content->type is XML_ELEMENT_CONTENT_ELEMENT, then (i) the content->prefix is appended to buf (if it actually fits) whereupon (ii) content->name is written to the buffer. However, the check for whether the content->name actually fits also uses 'len' rather than the updated buffer length strlen(buf). This allows us to write about "size" many bytes beyond the allocated memory. This vulnerability causes programs that use libxml2 to crash. References: http://seclists.org/oss-sec/2017/q2/258
Created libxml2 tracking bugs for this issue: Affects: fedora-all [bug 1452550]
Created mingw-libxml2 tracking bugs for this issue: Affects: fedora-all [bug 1452551]
Statement: This vulnerability exists in the DTD validation functionality of libxml2. Applications that do not attempt to validate untrusted documents are not impacted.
Upstream patch: https://gitlab.gnome.org/GNOME/libxml2/commit/932cc9896ab