3 ms·

A lot of software (including https://gitlab.com/openconnect/openconnect https://gitlab.com/openconnect/openconnect of which I'm a maintainer) uses libxml2, whic

• bananapub 3y ago
  > only to read and parse uncompressed XML… how does libxml2 know to decompress something? does it require you, as the caller, to explicitly tell it to? or does it look at the magic bytes or filename or mimetype or something?
  • dlenski 3y ago
    > how does libxml2 know to decompress something? > > does it require you, as the caller, to explicitly tell it to? In the entry point/function that we use, `xmlReadMemory` (https://gnome.pages.gitlab.gnome.org/libxml2/devhelp/libxml2-parser.html#xmlReadMemory https://gnome.pages.gitlab.gnome.org/libxml2/devhelp/libxml2...), it doesn't handle compressed XML at all. But there are indeed others where it attempts to auto-detect compression, although as I understand it from the docs only ZLib compression is autodetected… though I suspect these may be out-of-date and it may autodetect any/all compiled -in compression algorithms. Regardless, the fact that it links with liblzma is cause for concern, given the mechanism of operation of the liblzma/xz backdoor.
• enedil 3y ago
  This doesn't matter, if libxml2 loads .so and the library is malicious, you are already potentially compromised, as it is possible to run code on library load.