From c2e233fc1b341685fc99621b2768b503f777a72e Mon Sep 17 00:00:00 2001
From: Daniel Garcia Moreno <daniel.garcia@suse.com>
Date: Fri, 22 May 2026 12:21:20 +0200
Subject: [PATCH] xmlcatalog: overflow check for large --shell commands

Fix https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1124
---
 test/catalogs/test.sh | 11 +++++++++++
 xmlcatalog.c          | 16 ++++++++++++++++
 2 files changed, 27 insertions(+)

Index: libxml2-2.13.8/xmlcatalog.c
===================================================================
--- libxml2-2.13.8.orig/xmlcatalog.c
+++ libxml2-2.13.8/xmlcatalog.c
@@ -114,6 +114,12 @@ static void usershell(void) {
 	       (*cur != '\n') && (*cur != '\r')) {
 	    if (*cur == 0)
 		break;
+            /* Do not read beyond the command array capacity */
+            if (i >= (int)sizeof(command) - 2) {
+                printf("Invalid command %s\n", cur);
+                i = 0;
+                break;
+            }
 	    command[i++] = *cur++;
 	}
 	command[i] = 0;
@@ -131,6 +137,11 @@ static void usershell(void) {
 	while ((*cur != '\n') && (*cur != '\r') && (*cur != 0)) {
 	    if (*cur == 0)
 		break;
+            if (i >= (int)sizeof(arg) - 2) {
+                printf("Invalid arg %s\n", arg);
+                i = 0;
+                break;
+            }
 	    arg[i++] = *cur++;
 	}
 	arg[i] = 0;
@@ -143,6 +154,11 @@ static void usershell(void) {
 	cur = arg;
 	memset(argv, 0, sizeof(argv));
 	while (*cur != 0) {
+            if (i >= (int)sizeof(argv) / (int)sizeof(char*)) {
+                printf("Too much arguments\n");
+                break;
+            }
+
 	    while ((*cur == ' ') || (*cur == '\t')) cur++;
 	    if (*cur == '\'') {
 		cur++;