Bug#1145376: sdpb: please update bundled tinyxml2 (integer overflow in GetCharacterRef)

[Gajendra Nath Soren]

Package: sdpb
Version: 1.0-5
Severity: minor
Tags: security
X-Debbugs-Cc: gajendranath025 at gmail.com

sdpb vendors a copy of tinyxml2 at:
  src/tinyxml2/tinyxml2.cpp

This copy predates commit a737ecb (May 2026) which fixes an integer
overflow in GetCharacterRef() that could allow heap corruption via
crafted XML input. The fix adds:

  if (digitScaled > MAX_CODE_POINT || ucs > MAX_CODE_POINT - digitScaled)
      return 0;

No CVE has been assigned yet. The fix is public at:
  https://github.com/leethomason/tinyxml2/commit/a737ecb

Please update the bundled tinyxml2 to the latest upstream version.

Found by: Attack of the Clones GSoC 2026 pipeline
  (salsa.debian.org/rouca/gsoc2026)

Gajendra
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-science-maintainers/attachments/20260824/b433455e/attachment.htm>