In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks, aka a lack of a check for integer overflow before calling writecallback. This has security relevance for many types of uses of that length value within a callback.
💡 影响/原因: 原文内容(由于配额限制,未进行深度 LLM 分析)
🎯 建议动作: 建议根据原文自行评估