From 96c7467281c72028aada525c1d3822512758b266 Mon Sep 17 00:00:00 2001 From: Sebastian Pipping Date: Sun, 7 Sep 2025 12:06:43 +0200 Subject: [PATCH] lib: Exclude XML_Mem* functions from allocation tracking .. so that allocations by the user application are not being limited. CVE: CVE-2025-59375 Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/96c7467281c72028aada525c1d3822512758b266] Signed-off-by: Peter Marko --- lib/xmlparse.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/lib/xmlparse.c b/lib/xmlparse.c index 5d27cd45..8145a049 100644 --- a/lib/xmlparse.c +++ b/lib/xmlparse.c @@ -2781,21 +2781,31 @@ void *XMLCALL XML_MemMalloc(XML_Parser parser, size_t size) { if (parser == NULL) return NULL; - return MALLOC(parser, size); + + // NOTE: We are avoiding MALLOC(..) here to not include + // user allocations with allocation tracking and limiting. + return parser->m_mem.malloc_fcn(size); } void *XMLCALL XML_MemRealloc(XML_Parser parser, void *ptr, size_t size) { if (parser == NULL) return NULL; - return REALLOC(parser, ptr, size); + + // NOTE: We are avoiding REALLOC(..) here to not include + // user allocations with allocation tracking and limiting. + return parser->m_mem.realloc_fcn(ptr, size); } void XMLCALL XML_MemFree(XML_Parser parser, void *ptr) { if (parser == NULL) return; - FREE(parser, ptr); + + // NOTE: We are avoiding FREE(..) here because XML_MemMalloc and + // XML_MemRealloc are not using MALLOC(..) and REALLOC(..) + // but plain .malloc_fcn(..) and .realloc_fcn(..), internally. + parser->m_mem.free_fcn(ptr); } void XMLCALL