Harden index XML parsing against malformed input - #614
Open
matejk wants to merge 2 commits into
Open
Conversation
matejk
force-pushed
the
fix/index-parsing-hardening
branch
from
June 17, 2026 20:35
d031cd7 to
9293668
Compare
vandelvan
approved these changes
Jul 3, 2026
vandelvan
left a comment
vandelvan
left a comment
Member
There was a problem hiding this comment.
LGTM, Thank you for your contributions
matejk
force-pushed
the
fix/index-parsing-hardening
branch
from
August 17, 2026 20:10
9293668 to
8d3c6e3
Compare
XML_PARSE_HUGE disables libxml2's nesting limit, so a crafted index could overflow the C stack. Stack-safety bound, not a format limit.
NULL node name in xml_next_tag, unchecked malloc in decode_entry_name, unchecked realloc of glob_patterns, NULL value of the WORM xattrs.
matejk
force-pushed
the
fix/index-parsing-hardening
branch
2 times, most recently
from
August 17, 2026 20:28
09c786e to
9effc58
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Defects reachable from a crafted or truncated index while mounting a cartridge. Two commits:
_xml_parse_dirtreerecurses once per directory level and the index reader setsXML_PARSE_HUGE, which removes libxml2's own nesting limit, so deeply nested<directory>elements could overflow the C stack during mount. The bound (5051) is a stack-safety guard, not an LTFS format limit — the format defines no maximum depth — and is set well above any tree that fits in a conventionalPATH_MAX.xml_next_tagpassed a possibly-NULL libxml2 node name tostrcmp;decode_entry_namewrote to an allocation of attacker-controlled size without a NULL check; theglob_patternsgrowth dereferenced an uncheckedrealloc; anltfs.vendor.IBM.immutable/appendonlyxattr with an empty self-closing value passed NULL tostrcmpwhen deciding WORM flags, crashing the mount.