sergio/takana
> Una distribución Linux construida con un laboratorio funcional y hermético en el > sótano, y una terminal mutable, clásica y anárquica en el piso de arriba — diseñada > desde el suelo para que una IA programadora entienda, modifique y co…
Etapa G: libs C base pcre2 + libxml2 al corpus (223→225)
1--- a/testparser.c
2+++ b/testparser.c
3@@ -11,6 +11,7 @@
4 #include <libxml/xmlreader.h>
5 #include <libxml/xmlwriter.h>
6 #include <libxml/HTMLparser.h>
7+#include <libxml/xmlschemas.h>
8
9 #include <string.h>
10
11@@ -777,6 +778,63 @@
12 }
13 #endif /* WIN32 */
14
15+#if defined(LIBXML_READER_ENABLED) && defined(LIBXML_SCHEMAS_ENABLED)
16+/*
17+ * Regression test for CVE-2026-6732: a type confusion in xmlParseReference
18+ * crashed a schema-validating xmlTextReader whenever the document expanded
19+ * an internal entity. Without the fix this triggers SIGSEGV on the first
20+ * read; with the fix the entity expansion is read and the schema correctly
21+ * reports the substituted content as invalid against xs:integer.
22+ *
23+ * Backport of upstream commit 7cea3fd1 adapted for the libxml2 2.13
24+ * testparser.c layout (which predates the testReaderSchemaResourceLoader
25+ * helper that upstream uses as an anchor on master).
26+ */
27+static int
28+testReaderSchemaEntityExpansion(void) {
29+ static const char xsd[] =
30+ "<?xml version='1.0'?>\n"
31+ "<xs:schema xmlns:xs='http://www.w3.org/2001/XMLSchema'>\n"
32+ " <xs:element name='e' type='xs:integer'/>\n"
33+ "</xs:schema>\n";
34+ static const char xml[] =
35+ "<!DOCTYPE e [<!ENTITY n \"not-an-int\">]>\n"
36+ "<e>&n;</e>";
37+ xmlSchemaParserCtxtPtr spc;
38+ xmlSchemaPtr schema;
39+ xmlTextReaderPtr reader;
40+ int err = 0;
41+ int ret;
42+
43+ spc = xmlSchemaNewMemParserCtxt(xsd, (int) sizeof(xsd) - 1);
44+ schema = xmlSchemaParse(spc);
45+ xmlSchemaFreeParserCtxt(spc);
46+ if (schema == NULL) {
47+ fprintf(stderr, "xmlSchemaParse failed\n");
48+ return 1;
49+ }
50+
51+ reader = xmlReaderForMemory(xml, (int) sizeof(xml) - 1, "doc.xml", NULL,
52+ XML_PARSE_NOENT | XML_PARSE_DTDLOAD);
53+ xmlTextReaderSetSchema(reader, schema);
54+
55+ while ((ret = xmlTextReaderRead(reader)) == 1)
56+ ;
57+ if (ret != 0) {
58+ fprintf(stderr, "reader failed on entity-expanded document\n");
59+ err = 1;
60+ }
61+ if (xmlTextReaderIsValid(reader) != 0) {
62+ fprintf(stderr, "schema missed invalid entity-expanded text\n");
63+ err = 1;
64+ }
65+
66+ xmlFreeTextReader(reader);
67+ xmlSchemaFree(schema);
68+ return err;
69+}
70+#endif
71+
72 int
73 main(void) {
74 int err = 0;
75@@ -807,6 +865,9 @@
76 #ifdef LIBXML_XINCLUDE_ENABLED
77 err |= testReaderXIncludeError();
78 #endif
79+#ifdef LIBXML_SCHEMAS_ENABLED
80+ err |= testReaderSchemaEntityExpansion();
81+#endif
82 #endif
83 #ifdef LIBXML_WRITER_ENABLED
84 err |= testWriterClose();