[xml/sgml-pkgs] Bug#993638: Bug#993638: libxml2: XHTML 1.0 validation is broken

[Vincent Lefevre]

(We searched for the commmit at about the same time...)

On 2021-09-20 11:15:16 +0200, Mattia Rizzolo wrote:
> I bisected libxml2:
[...]

FYI, I found this commit just by looking at the git logs, with a
search for "predefined" (and "redeclaration" works too). This is
faster than bisecting. This is great that libxml2 has detailed
logs, not true for every software...

> > > In the latter case, I think that
> > > there should be a Breaks against w3c-dtd-xhtml.
> 
> On its way.

Thanks.

Please also make sure that the NEWS file is up-to-date; see my other
message. This is also useful for the user when getting regressions
in general (possibly from bug fixes like here).

BTW, the error message should be more detailed, e.g. saying which
entity and which URI. This would have made debugging so much easier.
But that's a separate issue; I'll report a bug upstream if this has
not already been done.

I'm wondering whether this check for invalid redeclarations of
predefined entities should also go to Debian/stable since it fixes
an integer overflow at the same time:

  https://gitlab.gnome.org/GNOME/libxml2/-/issues/217

Any security issue related to that?

-- 
Vincent Lefèvre <vincent at vinc17.net> - Web: <https://www.vinc17.net/>
100% accessible validated (X)HTML - Blog: <https://www.vinc17.net/blog/>
Work: CR INRIA - computer arithmetic / AriC project (LIP, ENS-Lyon)