From 595d7d8f6aac7f8374ad73ebe66479d1316f81a8 Mon Sep 17 00:00:00 2001
From: Daniel Garcia Moreno <daniel.garcia@suse.com>
Date: Mon, 4 May 2026 09:32:43 +0200
Subject: [PATCH] xpointer: Check overflow in xmlXPtrEvalXPtrPart

Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1113
---
 xpointer.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/xpointer.c b/xpointer.c
index 8a3b84161..846eba01a 100644
--- a/xpointer.c
+++ b/xpointer.c
@@ -263,6 +263,13 @@ xmlXPtrEvalXPtrPart(xmlXPathParserContextPtr ctxt, xmlChar *name) {
     level = 1;
 
     len = xmlStrlen(ctxt->cur);
+    /* Overflow in xmlStrlen */
+    if (len == 0 && ctxt->cur != NULL && *ctxt->cur != 0) {
+        xmlXPathPErrMemory(ctxt);
+        xmlFree(name);
+        return;
+    }
+
     len++;
     buffer = xmlMalloc(len);
     if (buffer == NULL) {
-- 
GitLab