From bbe186902eddca01cc2049780a1d1a37937d3862 Mon Sep 17 00:00:00 2001 From: Mingli Yu Date: Wed, 25 Feb 2026 16:16:14 +0800 Subject: [PATCH] shell: free cmdline before continue This patch frees the cmdline when it's not empty but it doesn't contain any actual character. If the cmdline is just whitespaces or \r and \n, the loop continues without freeing the cmdline string, so it's a leak. Fix #1009 Reference https://gitlab.gnome.org/GNOME/libxml2/-/commit/160c8a43 CVE: CVE-2026-1757 Upstream-Status: Backport [https://gitlab.gnome.org/GNOME/libxml2/-/commit/160c8a43] The shell is refactored [1], so backport the related code from shell.c to debugXML.c. [1] https://gitlab.gnome.org/GNOME/libxml2/-/commit/1341deac Signed-off-by: Mingli Yu --- debugXML.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/debugXML.c b/debugXML.c index 9d9618f..2d5c99d 100644 --- a/debugXML.c +++ b/debugXML.c @@ -2866,8 +2866,11 @@ xmlShell(xmlDocPtr doc, char *filename, xmlShellReadlineFunc input, command[i++] = *cur++; } command[i] = 0; - if (i == 0) + if (i == 0) { + free(cmdline); + cmdline = NULL; continue; + } /* * Parse the argument -- 2.34.1