Re: [OE-core][scarthgap][PATCH 5/6] libxml2: Security Fix for CVE-2026-86141

[Triet Hoang <triet.hoang.dev@gmail.com>]

On Fri, 11 Sep 2026 01:33:28 +0530 Siddharth Doshi wrote:

> +---
> + xmlregexp.c | 8 ++++++--
> + 1 file changed, 6 insertions(+), 2 deletions(-)
> +
> +diff --git a/xmlregexp.c b/xmlregexp.c
> +index 5e15311..1c1b25e 100644
> +--- a/xmlregexp.c
> ++++ b/xmlregexp.c
> +@@ -702,8 +702,12 @@ xmlRegNewParserCtxt(const xmlChar *string) {
> + 	return(NULL);
> +     memset(ret, 0, sizeof(xmlRegParserCtxt));
> +     if (string != NULL)
> +-	ret->string = xmlStrdup(string);
> +-	ret->len = strlen((const char *) ret->string);
> ++         ret->string = xmlStrdup(string);
> ++         if (ret->string == NULL) {
> ++             xmlFree(ret);
> ++             return(NULL);
> ++         }
> ++        ret->len = strlen((const char *) ret->string);
> +     ret->cur = ret->string;
> +     ret->neg = 0;
> +     ret->negs = 0;
> +-- 

The hunk keeps the brace-less if (string != NULL), so only ret->string = xmlStrdup(string);
is conditional. The NULL check below it always runs, and xmlRegNewParserCtxt() returns NULL
for every caller that passes string == NULL.

I think we need to backport [1] first before applying this patch.

[1] https://gitlab.gnome.org/GNOME/libxml2/-/commit/1a354d5b3072feaf64b5f6ea4b35e1bef35b7f65

BR,
Triet Hoang