From a6a2a49367f03f5d8a73c9027b45b59953ca27d8 Mon Sep 17 00:00:00 2001 From: Sebastian Pipping Date: Wed, 10 Sep 2025 19:52:39 +0200 Subject: [PATCH] docs: Promote the contract to call XML_FreeContentModel .. when registering a custom element declaration handler (via a call to function XML_SetElementDeclHandler) CVE: CVE-2025-59375 Upstream-Status: Backport [https://github.com/libexpat/libexpat/commit/a6a2a49367f03f5d8a73c9027b45b59953ca27d8] Signed-off-by: Peter Marko --- doc/reference.html | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/doc/reference.html b/doc/reference.html index 81da4e6c..564fc1b2 100644 --- a/doc/reference.html +++ b/doc/reference.html @@ -1902,7 +1902,7 @@ struct XML_cp {

Sets a handler for element declarations in a DTD. The handler gets called with the name of the element in the declaration and a pointer to a structure that contains the element model. It's the user code's -responsibility to free model when finished with it. See +responsibility to free model when finished with via a call to XML_FreeContentModel. There is no need to free the model from the handler, it can be kept around and freed at a later stage.