From 61e5f3ea97609bb221a355579d2285ddd28d90d2 Mon Sep 17 00:00:00 2001
From: mohammadmseet-hue <mohammadmseet@gmail.com>
Date: Thu, 16 Apr 2026 02:54:37 +0200
Subject: [PATCH] fix: add bounds checks to xmlSnprintfElements in valid.c

CVE-2025-24928 fixed xmlSnprintfElementContent for unchecked strcat()
writes, but the sibling function xmlSnprintfElements has the identical
unfixed pattern. The strcat(buf, "(") before the while loop and
strcat(buf, ")") after the loop exit have no bounds checks.

Add remaining-space checks before both strcat calls, with early return
and ellipsis when space is insufficient.
---
 valid.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/valid.c b/valid.c
index 9dbace651..774f51a3d 100644
--- a/valid.c
+++ b/valid.c
@@ -4625,7 +4625,15 @@ xmlSnprintfElements(char *buf, int size, xmlNodePtr node, int glob) {
     int len;
 
     if (node == NULL) return;
-    if (glob) strcat(buf, "(");
+    len = strlen(buf);
+    if (glob) {
+        if (size - len < 50) {
+            if ((size - len > 4) && (buf[len - 1] != '.'))
+                strcat(buf, " ...");
+            return;
+        }
+        strcat(buf, "(");
+    }
     cur = node;
     while (cur != NULL) {
 	len = strlen(buf);
@@ -4689,7 +4697,11 @@ xmlSnprintfElements(char *buf, int size, xmlNodePtr node, int glob) {
 	}
 	cur = cur->next;
     }
-    if (glob) strcat(buf, ")");
+    if (glob) {
+        len = strlen(buf);
+        if (size - len > 1)
+            strcat(buf, ")");
+    }
 }
 
 /**
-- 
GitLab