[System]
You are a security engineer fixing a CVE. You are given the vulnerability description (symptom only) and the vulnerable source window. Author the MINIMAL fix as one or more SEARCH/REPLACE blocks. Follow these rules exactly:
1. Each block is:
<<<<<<< SEARCH
<exact lines copied verbatim from the shown source window>
=======
<the replacement lines>
>>>>>>> REPLACE
2. The SEARCH text MUST appear verbatim in the shown source window — copy it exactly, including whitespace; do not invent or paraphrase it.
3. Change as few lines as possible; keep the SEARCH span tight around the edit.
4. Modify ONLY code visible in the shown source window.
5. Output only the SEARCH/REPLACE block(s) with no other text.
6. Prefer folding a new bound or check into an existing condition over adding a separate guard, when the upstream fix does so.

[User]
# CVE
CVE-2025-10911: This allows an attacker to trigger use-after-free via a crafted XSL stylesheet that causes expired pointers to be dereferenced.

# Vulnerable source (libxslt/xsltInternals.h)
```c
    const xmlChar *stype;       /* sort */
    int      has_stype;		/* sort */
    int      number;		/* sort */
    const xmlChar *order;	/* sort */
    int      has_order;		/* sort */
    int      descending;	/* sort */
    const xmlChar *lang;	/* sort */
    int      has_lang;		/* sort */
    const xmlChar *case_order;	/* sort */
    int      lower_first;	/* sort */

    const xmlChar *use;		/* copy, element */
    int      has_use;		/* copy, element */

    int      noescape;		/* text */

    const xmlChar *name;	/* element, attribute, pi */
    int      has_name;		/* element, attribute, pi */
    const xmlChar *ns;		/* element */
    int      has_ns;		/* element */

    const xmlChar *mode;	/* apply-templates */
    const xmlChar *modeURI;	/* apply-templates */

    const xmlChar *test;	/* if */

    xsltTemplatePtr templ;	/* call-template */

    const xmlChar *select;	/* sort, copy-of, value-of, apply-templates */

    int      ver11;		/* document */
    const xmlChar *filename;	/* document URL */
    int      has_filename;	/* document */

    xsltNumberData numdata;	/* number */

    xmlXPathCompExprPtr comp;	/* a precompiled XPath expression */
    xmlNsPtr *nsList;		/* the namespaces in scope */
    int nsNr;			/* the number of namespaces in scope */
};

#endif /* XSLT_REFACTORED */

/*
 * The in-memory structure corresponding to an XSLT Variable
 * or Param.
 */
typedef struct _xsltStackElem xsltStackElem;
typedef xsltStackElem *xsltStackElemPtr;
struct _xsltStackElem {
    struct _xsltStackElem *next;/* chained list */
    xsltStylePreCompPtr comp;   /* the compiled form */
    int computed;		/* was the evaluation done */
    const xmlChar *name;	/* the local part of the name QName */
    const xmlChar *nameURI;	/* the URI part of the name QName */
    const xmlChar *select;	/* the eval string */
    xmlNodePtr tree;		/* the sequence constructor if no eval
				    string or the location */
    xmlXPathObjectPtr value;	/* The value if computed */
    xmlDocPtr fragment;		/* The Result Tree Fragments (needed for XSLT 1.0)
				   which are bound to the variable's lifetime. */
    int level;                  /* the depth in the tree;
                                   -1 if persistent (e.g. a given xsl:with-param) */
    xsltTransformContextPtr context; /* The transformation context; needed to cache
                                        the variables */
    int flags;
};

#ifdef XSLT_REFACTORED

struct _xsltPrincipalStylesheetData {
    /*
    * Namespace dictionary for ns-prefixes and ns-names:
    * TODO: Shared between stylesheets, and XPath mechanisms.
    *   Not used yet.
    */
    xmlDictPtr namespaceDict;
    /*
    * Global list of in-scope namespaces.
    */
    xsltPointerListPtr inScopeNamespaces;
    /*
    * Global list of information for [xsl:]excluded-result-prefixes.
    */
    xsltPointerListPtr exclResultNamespaces;
    /*
    * Global list of information for [xsl:]extension-element-prefixes.
    */
    xsltPointerListPtr extElemNamespaces;
    xsltEffectiveNsPtr effectiveNs;
#ifdef XSLT_REFACTORED_XSLT_NSCOMP
    /*
    * Namespace name map to get rid of string comparison of namespace names.
    */
    xsltNsMapPtr nsMap;
#endif
};

#endif
/*
 * Note that we added a @compCtxt field to anchor an stylesheet compilation
 * context, since, due to historical reasons, various compile-time function
 * take only the stylesheet as argument and not a compilation context.
 */
struct _xsltStylesheet {
    /*
     * The stylesheet import relation is kept as a tree.
     */
    struct _xsltStylesheet *parent;
    struct _xsltStylesheet *next;
    struct _xsltStylesheet *imports;

    xsltDocumentPtr docList;		/* the include document list */

    /*
     * General data on the style sheet document.
     */
    xmlDocPtr doc;		/* the parsed XML stylesheet */
    xmlHashTablePtr stripSpaces;/* the hash table of the strip-space and
				   preserve space elements */
    int             stripAll;	/* strip-space * (1) preserve-space * (-1) */
    xmlHashTablePtr cdataSection;/* the hash table of the cdata-section */

    /*
     * Global variable or parameters.
     */
    xsltStackElemPtr variables; /* linked list of param and variables */

    /*
     * Template descriptions.
     */
    xsltTemplatePtr templates;           /* the ordered list of templates */
    xmlHashTablePtr templatesHash;       /* hash table or wherever compiled
                                            templates information is stored */
    struct _xsltCompMatch *rootMatch;    /* template based on / */
    struct _xsltCompMatch *keyMatch;     /* template based on key() */
    struct _xsltCompMatch *elemMatch;    /* template based on * */
    struct _xsltCompMatch *attrMatch;    /* template based on @* */
    struct _xsltCompMatch *parentMatch;  /* template based on .. */
    struct _xsltCompMatch *textMatch;    /* template based on text() */
    struct _xsltCompMatch *piMatch;      /* template based on
                                            processing-instruction() */
    struct _xsltCompMatch *commentMatch; /* template based on comment() */

    /*
     * Namespace aliases.
     * NOTE: Not used in the refactored code.
     */
    xmlHashTablePtr nsAliases;	/* the namespace alias hash tables */

    /*
     * Attribute sets.
     */
    xmlHashTablePtr attributeSets;/* the attribute sets hash tables */

    /*
     * Namespaces.
     * TODO: Eliminate this.
     */
    xmlHashTablePtr nsHash;     /* the set of namespaces in use:
                                   ATTENTION: This is used for
                                   execution of XPath expressions; unfortunately
                                   it restricts the stylesheet to have distinct
                                   prefixes.
				   TODO: We need to get rid of this.
				 */
    void           *nsDefs;     /* ATTENTION TODO: This is currently used to store
				   xsltExtDefPtr (in extensions.c) and
                                   *not* xmlNsPtr.
				 */

    /*
     * Key definitions.
     */
    void *keys;			/* key definitions */

    /*
     * Output related stuff.
     */
    xmlChar *method;		/* the output method */
    xmlChar *methodURI;		/* associated namespace if any */
    xmlChar *version;		/* version string */
    xmlChar *encoding;		/* encoding string */
    int omitXmlDeclaration;     /* omit-xml-declaration = "yes" | "no" */

    /*
     * Number formatting.
     */
    xsltDecimalFormatPtr decimalFormat;
    int standalone;             /* standalone = "yes" | "no" */
    xmlChar *doctypePublic;     /* doctype-public string */
    xmlChar *doctypeSystem;     /* doctype-system string */
    int indent;			/* should output being indented */
    xmlChar *mediaType;		/* media-type string */

    /*
     * Precomputed blocks.
     */
    xsltElemPreCompPtr preComps;/* list of precomputed blocks */
    int warnings;		/* number of warnings found at compilation */
    int errors;			/* number of errors found at compilation */

    xmlChar  *exclPrefix;	/* last excluded prefixes */
    xmlChar **exclPrefixTab;	/* array of excluded prefixes */
    int       exclPrefixNr;	/* number of excluded prefixes in scope */
    int       exclPrefixMax;	/* size of the array */

    void     *_private;		/* user defined data */

    /*
     * Extensions.
     */
    xmlHashTablePtr extInfos;	/* the extension data */
    int		    extrasNr;	/* the number of extras required */

    /*
     * For keeping track of nested includes
     */
    xsltDocumentPtr includes;	/* points to last nested include */

    /*
     * dictionary: shared between stylesheet, context and documents.
     */
    xmlDictPtr dict;
    /*
     * precompiled attribute value templates.
     */
    void *attVTs;
    /*
     * if namespace-alias has an alias for the default stylesheet prefix
     * NOTE: Not used in the refactored code.
     */
    const xmlChar *defaultAlias;
    /*
     * bypass pre-processing (already done) (used in imports)
     */
    int nopreproc;
    /*
     * all document text strings were internalized
     */
    int internalized;
    /*
     * Literal Result Element as Stylesheet c.f. section 2.3
     */
    int literal_result;
    /*
    * The principal stylesheet
    */
    xsltStylesheetPtr principal;
#ifdef XSLT_REFACTORED
    /*
    * Compilation context used during compile-time.
    */
    xsltCompilerCtxtPtr compCtxt; /* TODO: Change this to (void *). */

    xsltPrincipalStylesheetDataPtr principalData;
#endif
    /*
     * Forwards-compatible processing
     */
    int forwards_compatible;

    xmlHashTablePtr namedTemplates; /* hash table of named templates */

    xmlXPathContextPtr xpathCtxt;

    unsigned long opLimit;
    unsigned long opCount;
};

typedef struct _xsltTransformCache xsltTransformCache;
typedef xsltTransformCache *xsltTransformCachePtr;
struct _xsltTransformCache {
    xmlDocPtr RVT;
    int nbRVT;
    xsltStackElemPtr stackItems;
    int nbStackItems;
#ifdef XSLT_DEBUG_PROFILE_CACHE
    int dbgCachedRVTs;
    int dbgReusedRVTs;
    int dbgCachedVars;
    int dbgReusedVars;
#endif
};

/*
 * The in-memory structure corresponding to an XSLT Transformation.
 */
typedef enum {
    XSLT_OUTPUT_XML = 0,
    XSLT_OUTPUT_HTML,
    XSLT_OUTPUT_TEXT
} xsltOutputType;

typedef void *
(*xsltNewLocaleFunc)(const xmlChar *lang, int lowerFirst);
typedef void
(*xsltFreeLocaleFunc)(void *locale);
typedef xmlChar *
(*xsltGenSortKeyFunc)(void *locale, const xmlChar *lang);

typedef enum {
    XSLT_STATE_OK = 0,
    XSLT_STATE_ERROR,
    XSLT_STATE_STOPPED
} xsltTransformState;

struct _xsltTransformContext {
    xsltStylesheetPtr style;		/* the stylesheet used */
    xsltOutputType type;		/* the type of output */

    xsltTemplatePtr  templ;		/* the current template */
    int              templNr;		/* Nb of templates in the stack */
    int              templMax;		/* Size of the templtes stack */
    xsltTemplatePtr *templTab;		/* the template stack */

    xsltStackElemPtr  vars;		/* the current variable list */
    int               varsNr;		/* Nb of variable list in the stack */
    int               varsMax;		/* Size of the variable list stack */
    xsltStackElemPtr *varsTab;		/* the variable list stack */
    int               varsBase;		/* the var base for current templ */

    /*
     * Extensions
     */
    xmlHashTablePtr   extFunctions;	/* the extension functions */
    xmlHashTablePtr   extElements;	/* the extension elements */
    xmlHashTablePtr   extInfos;		/* the extension data */

    const xmlChar *mode;		/* the current mode */
    const xmlChar *modeURI;		/* the current mode URI */

    xsltDocumentPtr docList;		/* the document list */

    xsltDocumentPtr document;		/* the current source document; can be NULL if an RTF */
    xmlNodePtr node;			/* the current node being processed */
    xmlNodeSetPtr nodeList;		/* the current node list */
    /* xmlNodePtr current;			the node */

    xmlDocPtr output;			/* the resulting document */
    xmlNodePtr insert;			/* the insertion node */

    xmlXPathContextPtr xpathCtxt;	/* the XPath context */
    xsltTransformState state;		/* the current state */

    /*
     * Global variables
     */
    xmlHashTablePtr   globalVars;	/* the global variables and params */

    xmlNodePtr inst;			/* the instruction in the stylesheet */

    int xinclude;			/* should XInclude be processed */

    const char *      outputFile;	/* the output URI if known */

    int profile;                        /* is this run profiled */
    long             prof;		/* the current profiled value */
    int              profNr;		/* Nb of templates in the stack */
    int              profMax;		/* Size of the templtaes stack */
    long            *profTab;		/* the profile template stack */

    void            *_private;		/* user defined data */

    int              extrasNr;		/* the number of extras used */
    int              extrasMax;		/* the number of extras allocated */
    xsltRuntimeExtraPtr extras;		/* extra per runtime information */

    xsltDocumentPtr  styleList;		/* the stylesheet docs list */
    void                 * sec;		/* the security preferences if any */

    xmlGenericErrorFunc  error;		/* a specific error handler */
    void              * errctx;		/* context for the error handler */

    xsltSortFunc      sortfunc;		/* a ctxt specific sort routine */

    /*
     * handling of temporary Result Value Tree
     * (XSLT 1.0 term: "Result Tree Fragment")
     */
    xmlDocPtr       tmpRVT;		/* list of RVT without persistance */
    xmlDocPtr       persistRVT;		/* list of persistant RVTs */
    int             ctxtflags;          /* context processing flags */

    /*
     * Speed optimization when coalescing text nodes
     */
    const xmlChar  *lasttext;		/* last text node content */
    int             lasttsize;		/* last text node size */
    int             lasttuse;		/* last text node use */
    /*
     * Per Context Debugging
     */
    int debugStatus;			/* the context level debug status */
    unsigned long* traceCode;		/* pointer to the variable holding the mask */

    int parserOptions;			/* parser options xmlParserOption */

    /*
     * dictionary: shared between stylesheet, context and documents.
     */
    xmlDictPtr dict;
    xmlDocPtr		tmpDoc; /* Obsolete; not used in the library. */
    /*
     * all document text strings are internalized
     */
    int internalized;
    int nbKeys;
    int hasTemplKeyPatterns;
    xsltTemplatePtr currentTemplateRule; /* the Current Template Rule */
    xmlNodePtr initialContextNode;
    xmlDocPtr initialContextDoc;
    xsltTransformCachePtr cache;
    void *contextVariable; /* the current variable item */
    xmlDocPtr localRVT; /* list of local tree fragments; will be freed when
			   the instruction which created the fragment
                           exits */
    xmlDocPtr localRVTBase; /* Obsolete */
    int keyInitLevel;   /* Needed to catch recursive keys issues */
    int depth;          /* Needed to catch recursions */
    int maxTemplateDepth;
    int maxTemplateVars;
    unsigned long opLimit;
    unsigned long opCount;
    int sourceDocDirty;
    unsigned long currentId; /* For generate-id() */

    xsltNewLocaleFunc newLocale;
    xsltFreeLocaleFunc freeLocale;
    xsltGenSortKeyFunc genSortKey;
};

/**
 * CHECK_STOPPED:
 *
 * Macro to check if the XSLT processing should be stopped.
 * Will return from the function.
 */
#define CHECK_STOPPED if (ctxt->state == XSLT_STATE_STOPPED) return;

/**
 * CHECK_STOPPEDE:
 *
 * Macro to check if the XSLT processing should be stopped.
 * Will goto the error: label.
 */
#define CHECK_STOPPEDE if (ctxt->state == XSLT_STATE_STOPPED) goto error;

/**
 * CHECK_STOPPED0:
 *
 * Macro to check if the XSLT processing should be stopped.
 * Will return from the function with a 0 value.
 */
#define CHECK_STOPPED0 if (ctxt->state == XSLT_STATE_STOPPED) return(0);

/*
 * The macro XML_CAST_FPTR is a hack to avoid a gcc warning about
 * possible incompatibilities between function pointers and object
 * pointers.  It is defined in libxml/hash.h within recent versions
 * of libxml2, but is put here for compatibility.
 */
#ifndef XML_CAST_FPTR
/**
 * XML_CAST_FPTR:
 * @fptr:  pointer to a function
 *
 * Macro to do a casting from an object pointer to a
 * function pointer without encountering a warning from
 * gcc
 *
 * #define XML_CAST_FPTR(fptr) (*(void **)(&fptr))
 * This macro violated ISO C aliasing rules (gcc4 on s390 broke)
 * so it is disabled now
 */

#define XML_CAST_FPTR(fptr) fptr
#endif
/*
 * Functions associated to the internal types
xsltDecimalFormatPtr	xsltDecimalFormatGetByName(xsltStylesheetPtr sheet,
						   xmlChar *name);
 */
XSLTPUBFUN xsltStylesheetPtr XSLTCALL
			xsltNewStylesheet	(void);
XSLTPUBFUN xsltStylesheetPtr XSLTCALL
			xsltParseStylesheetFile	(const xmlChar* filename);
XSLTPUBFUN void XSLTCALL
			xsltFreeStylesheet	(xsltStylesheetPtr style);
XSLTPUBFUN int XSLTCALL
			xsltIsBlank		(xmlChar *str);
XSLTPUBFUN void XSLTCALL
			xsltFreeStackElemList	(xsltStackElemPtr elem);
XSLTPUBFUN xsltDecimalFormatPtr XSLTCALL
			xsltDecimalFormatGetByName(xsltStylesheetPtr style,
						 xmlChar *name);
XSLTPUBFUN xsltDecimalFormatPtr XSLTCALL
			xsltDecimalFormatGetByQName(xsltStylesheetPtr style,
						 const xmlChar *nsUri,
                                                 const xmlChar *name);

XSLTPUBFUN xsltStylesheetPtr XSLTCALL
			xsltParseStylesheetProcess(xsltStylesheetPtr ret,
						 xmlDocPtr doc);
XSLTPUBFUN void XSLTCALL
			xsltParseStylesheetOutput(xsltStylesheetPtr style,
						 xmlNodePtr cur);
XSLTPUBFUN xsltStylesheetPtr XSLTCALL
			xsltParseStylesheetDoc	(xmlDocPtr doc);
XSLTPUBFUN xsltStylesheetPtr XSLTCALL
			xsltParseStylesheetImportedDoc(xmlDocPtr doc,
						xsltStylesheetPtr style);
XSLTPUBFUN int XSLTCALL
			xsltParseStylesheetUser(xsltStylesheetPtr style,
						xmlDocPtr doc);
XSLTPUBFUN xsltStylesheetPtr XSLTCALL
			xsltLoadStylesheetPI	(xmlDocPtr doc);
XSLTPUBFUN void XSLTCALL
			xsltNumberFormat	(xsltTransformContextPtr ctxt,
						 xsltNumberDataPtr data,
						 xmlNodePtr node);
XSLTPUBFUN xmlXPathError XSLTCALL
			xsltFormatNumberConversion(xsltDecimalFormatPtr self,
						 xmlChar *format,
						 double number,
						 xmlChar **result);

XSLTPUBFUN void XSLTCALL
			xsltParseTemplateContent(xsltStylesheetPtr style,
						 xmlNodePtr templ);
XSLTPUBFUN int XSLTCALL
			xsltAllocateExtra	(xsltStylesheetPtr style);
XSLTPUBFUN int XSLTCALL
			xsltAllocateExtraCtxt	(xsltTransformContextPtr ctxt);
/*
 * Extra functions for Result Value Trees
 */
XSLTPUBFUN xmlDocPtr XSLTCALL
			xsltCreateRVT		(xsltTransformContextPtr ctxt);
XSLTPUBFUN int XSLTCALL
			xsltRegisterTmpRVT	(xsltTransformContextPtr ctxt,
						 xmlDocPtr RVT);
XSLTPUBFUN int XSLTCALL
			xsltRegisterLocalRVT	(xsltTransformContextPtr ctxt,
						 xmlDocPtr RVT);
XSLTPUBFUN int XSLTCALL
			xsltRegisterPersistRVT	(xsltTransformContextPtr ctxt,
						 xmlDocPtr RVT);
XSLTPUBFUN int XSLTCALL
			xsltExtensionInstructionResultRegister(
						 xsltTransformContextPtr ctxt,
						 xmlXPathObjectPtr obj);
XSLTPUBFUN int XSLTCALL
			xsltExtensionInstructionResultFinalize(
						 xsltTransformContextPtr ctxt);
XSLTPUBFUN int XSLTCALL
			xsltFlagRVTs(
						 xsltTransformContextPtr ctxt,
						 xmlXPathObjectPtr obj,
						 int val);
XSLTPUBFUN void XSLTCALL
			xsltFreeRVTs		(xsltTransformContextPtr ctxt);
XSLTPUBFUN void XSLTCALL
			xsltReleaseRVT		(xsltTransformContextPtr ctxt,
						 xmlDocPtr RVT);
/*
 * Extra functions for Attribute Value Templates
 */
XSLTPUBFUN void XSLTCALL
			xsltCompileAttr		(xsltStylesheetPtr style,
						 xmlAttrPtr attr);
XSLTPUBFUN xmlChar * XSLTCALL
			xsltEvalAVT		(xsltTransformContextPtr ctxt,
						 void *avt,
						 xmlNodePtr node);
XSLTPUBFUN void XSLTCALL
			xsltFreeAVTList		(void *avt);

/*
 * Extra function for successful xsltCleanupGlobals / xsltInit sequence.
 */

XSLTPUBFUN void XSLTCALL
			xsltUninit		(void);

/************************************************************************
 *									*
 *  Compile-time functions for *internal* use only                      *
 *									*
 ************************************************************************/

#ifdef XSLT_REFACTORED
XSLTPUBFUN void XSLTCALL
			xsltParseSequenceConstructor(
						 xsltCompilerCtxtPtr cctxt,
						 xmlNodePtr start);
XSLTPUBFUN int XSLTCALL
			xsltParseAnyXSLTElem	(xsltCompilerCtxtPtr cctxt,
						 xmlNodePtr elem);
#ifdef XSLT_REFACTORED_XSLT_NSCOMP
XSLTPUBFUN int XSLTCALL
			xsltRestoreDocumentNamespaces(
						 xsltNsMapPtr ns,
						 xmlDocPtr doc);
#endif
#endif /* XSLT_REFACTORED */

/************************************************************************
 *									*
 *  Transformation-time functions for *internal* use only               *
 *									*
 ************************************************************************/
XSLTPUBFUN int XSLTCALL
			xsltInitCtxtKey		(xsltTransformContextPtr ctxt,
						 xsltDocumentPtr doc,
						 xsltKeyDefPtr keyd);
XSLTPUBFUN int XSLTCALL
			xsltInitAllDocKeys	(xsltTransformContextPtr ctxt);
#ifdef __cplusplus
}
#endif

#endif /* __XML_XSLT_H__ */

```

[Assistant]
<<<<<<< SEARCH

#endif /* XSLT_REFACTORED */

/*
 * The in-memory structure corresponding to an XSLT Variable
=======

#endif /* XSLT_REFACTORED */

typedef struct _xsltRVTList xsltRVTList;
typedef xsltRVTList *xsltRVTListPtr;

/*
 * The in-memory structure corresponding to an XSLT Variable
>>>>>>> REPLACE
<<<<<<< SEARCH
    xmlNodePtr tree;		/* the sequence constructor if no eval
				    string or the location */
    xmlXPathObjectPtr value;	/* The value if computed */
    xmlDocPtr fragment;		/* The Result Tree Fragments (needed for XSLT 1.0)
				   which are bound to the variable's lifetime. */
    int level;                  /* the depth in the tree;
                                   -1 if persistent (e.g. a given xsl:with-param) */
=======
    xmlNodePtr tree;		/* the sequence constructor if no eval
				    string or the location */
    xmlXPathObjectPtr value;	/* The value if computed */
    xsltRVTListPtr fragment;	/* The Result Tree Fragments (needed for XSLT 1.0)
				   which are bound to the variable's lifetime. */
    int level;                  /* the depth in the tree;
                                   -1 if persistent (e.g. a given xsl:with-param) */
>>>>>>> REPLACE
<<<<<<< SEARCH
    unsigned long opCount;
};

typedef struct _xsltTransformCache xsltTransformCache;
typedef xsltTransformCache *xsltTransformCachePtr;
struct _xsltTransformCache {
    xmlDocPtr RVT;
    int nbRVT;
    xsltStackElemPtr stackItems;
    int nbStackItems;
=======
    unsigned long opCount;
};

struct _xsltRVTList {
  xmlDocPtr RVT;
  xsltRVTListPtr next;
};

typedef struct _xsltTransformCache xsltTransformCache;
typedef xsltTransformCache *xsltTransformCachePtr;
struct _xsltTransformCache {
    xsltRVTListPtr rvtList;
    int nbRVT;
    xsltStackElemPtr stackItems;
    int nbStackItems;
>>>>>>> REPLACE
<<<<<<< SEARCH
     * handling of temporary Result Value Tree
     * (XSLT 1.0 term: "Result Tree Fragment")
     */
    xmlDocPtr       tmpRVT;		/* list of RVT without persistance */
    xmlDocPtr       persistRVT;		/* list of persistant RVTs */
    int             ctxtflags;          /* context processing flags */

    /*
=======
     * handling of temporary Result Value Tree
     * (XSLT 1.0 term: "Result Tree Fragment")
     */
    xsltRVTListPtr  tmpRVTList;	        /* list of RVT without persistance */
    xsltRVTListPtr  persistRVTList;     /* list of persistant RVTs */
    int             ctxtflags;          /* context processing flags */

    /*
>>>>>>> REPLACE
<<<<<<< SEARCH
    xmlDocPtr initialContextDoc;
    xsltTransformCachePtr cache;
    void *contextVariable; /* the current variable item */
    xmlDocPtr localRVT; /* list of local tree fragments; will be freed when
			   the instruction which created the fragment
                           exits */
    xmlDocPtr localRVTBase; /* Obsolete */
=======
    xmlDocPtr initialContextDoc;
    xsltTransformCachePtr cache;
    void *contextVariable; /* the current variable item */
    xsltRVTListPtr localRVTList; /* list of local tree fragments; will be freed when
			   the instruction which created the fragment
                           exits */
    xmlDocPtr localRVTBase; /* Obsolete */
>>>>>>> REPLACE
<<<<<<< SEARCH
XSLTPUBFUN void XSLTCALL
			xsltFreeRVTs		(xsltTransformContextPtr ctxt);
XSLTPUBFUN void XSLTCALL
			xsltReleaseRVT		(xsltTransformContextPtr ctxt,
						 xmlDocPtr RVT);
/*
 * Extra functions for Attribute Value Templates
 */
=======
XSLTPUBFUN void XSLTCALL
			xsltFreeRVTs		(xsltTransformContextPtr ctxt);
XSLTPUBFUN void XSLTCALL
			xsltReleaseRVT          (xsltTransformContextPtr ctxt,
						 xmlDocPtr RVT);
XSLTPUBFUN void XSLTCALL
			xsltReleaseRVTList	(xsltTransformContextPtr ctxt,
						 xsltRVTListPtr list);
/*
 * Extra functions for Attribute Value Templates
 */
>>>>>>> REPLACE
<<<<<<< SEARCH
#endif

#endif /* __XML_XSLT_H__ */

=======
#endif

#endif /* __XML_XSLT_H__ */
>>>>>>> REPLACE


[System]
You are a security engineer fixing a CVE. You are given the vulnerability description (symptom only) and the vulnerable source window. Author the MINIMAL fix as one or more SEARCH/REPLACE blocks. Follow these rules exactly:
1. Each block is:
<<<<<<< SEARCH
<exact lines copied verbatim from the shown source window>
=======
<the replacement lines>
>>>>>>> REPLACE
2. The SEARCH text MUST appear verbatim in the shown source window — copy it exactly, including whitespace; do not invent or paraphrase it.
3. Change as few lines as possible; keep the SEARCH span tight around the edit.
4. Modify ONLY code visible in the shown source window.
5. Output only the SEARCH/REPLACE block(s) with no other text.
6. Prefer folding a new bound or check into an existing condition over adding a separate guard, when the upstream fix does so.

[User]
# CVE
CVE-2025-11230: Algorithmic complexity denial-of-service (CWE-407) in HAProxy 3.2.5 and earlier via the bundled mjson library. The custom `mystrtod()` function in `src/mjson.c` computes the exponential part of a floating-point number using a linear O(n) loop (`for (i = 0; i < e; i++) d *= 10`), where `e` is the unvalidated exponent from the JSON input. An attacker submitting a specially crafted JSON value with a large positive exponent (e.g. `1e99999`) forces HAProxy to execute a proportionally large number of multiplications, consuming unbounded CPU time. Although HAProxy's internal watchdog will terminate a runaway process, the repeated triggering causes denial of service. Reported by Oula Kivalo.

# Vulnerable source (src/mjson.c)
```c
  d *= sign;

  /* fraction part */
  if (*p == '.') {
    double f = 0.0;
    double base = 0.1;
    ++p;

    if (is_digit(*p)) {
      while (*p && is_digit(*p)) {
        f += base * (*p - '0');
        base /= 10.0;
        ++p;
        ++n;
      }
    }
    d += f * sign;
    a = p;
  }

  /* exponential part */
  if ((*p == 'E') || (*p == 'e')) {
    int i, e = 0, neg = 0;
    p++;
    if (*p == '-') p++, neg++;
    if (*p == '+') p++;
    while (is_digit(*p)) e = e * 10 + *p++ - '0';
    if (neg) e = -e;
#if 0
    if (d == 2.2250738585072011 && e == -308) {
      d = 0.0;
      a = p;
      goto done;
    }
    if (d == 2.2250738585072012 && e <= -308) {
      d *= 1.0e-308;
      a = p;
      goto done;
    }
#endif
    for (i = 0; i < e; i++) d *= 10;
    for (i = 0; i < -e; i++) d /= 10;
    a = p;
  } else if (p > str && !is_digit(*(p - 1))) {
    a = str;
    goto done;
  }

done:
  if (end) *end = (char *) a;
  return d;
}

#if MJSON_ENABLE_MERGE
int mjson_merge(const char *s, int n, const char *s2, int n2,
                mjson_print_fn_t fn, void *userdata) {
  int koff, klen, voff, vlen, t, t2, k, off = 0, len = 0, comma = 0;
  if (n < 2) return len;
```

[Assistant]
<<<<<<< SEARCH

  /* exponential part */
  if ((*p == 'E') || (*p == 'e')) {
    int i, e = 0, neg = 0;
    p++;
    if (*p == '-') p++, neg++;
    if (*p == '+') p++;
    while (is_digit(*p)) e = e * 10 + *p++ - '0';
    if (neg) e = -e;
#if 0
    if (d == 2.2250738585072011 && e == -308) {
=======

  /* exponential part */
  if ((*p == 'E') || (*p == 'e')) {
    double exp, f;
    int i, e = 0, neg = 0;
    p++;
    if (*p == '-') p++, neg++;
    if (*p == '+') p++;
    while (is_digit(*p)) e = e * 10 + *p++ - '0';
    i = e;
    if (neg) e = -e;
#if 0
    if (d == 2.2250738585072011 && e == -308) {
>>>>>>> REPLACE
<<<<<<< SEARCH
      goto done;
    }
#endif
    for (i = 0; i < e; i++) d *= 10;
    for (i = 0; i < -e; i++) d /= 10;
    a = p;
  } else if (p > str && !is_digit(*(p - 1))) {
    a = str;
=======
      goto done;
    }
#endif
    /* calculate f = 10^i */
    exp = 10;
    f = 1;
    while (i > 0) {
      if (i & 1) f *= exp;
      exp *= exp;
      i >>= 1;
    }
    if (e > 0) d *= f;
    else if (e < 0) d /= f;
    a = p;
  } else if (p > str && !is_digit(*(p - 1))) {
    a = str;
>>>>>>> REPLACE


[System]
You are a security engineer fixing a CVE. You are given the vulnerability description (symptom only) and the vulnerable source window. Author the MINIMAL fix as one or more SEARCH/REPLACE blocks. Follow these rules exactly:
1. Each block is:
<<<<<<< SEARCH
<exact lines copied verbatim from the shown source window>
=======
<the replacement lines>
>>>>>>> REPLACE
2. The SEARCH text MUST appear verbatim in the shown source window — copy it exactly, including whitespace; do not invent or paraphrase it.
3. Change as few lines as possible; keep the SEARCH span tight around the edit.
4. Modify ONLY code visible in the shown source window.
5. Output only the SEARCH/REPLACE block(s) with no other text.
6. Prefer folding a new bound or check into an existing condition over adding a separate guard, when the upstream fix does so.

[User]
# CVE
CVE-2025-14905: 389 Directory Server allocates a buffer for serializing LDAP attribute type definitions by summing component widths without accounting for all literal prefix strings in the output format, allowing a crafted LDAP client to trigger a heap overflow when the server emits its attribute type schema.

# Vulnerable source (ldap/servers/slapd/schema.c)
```c

    if (rc == 0) { /* all matched so far */
        /* get rid of trailing ignored strings (if any) */
        if (NULL != ignorestr) {
            if (sa1[i1] != NULL && 0 == strcmp(sa1[i1], ignorestr)) {
                ++i1;
            }
            if (sa2[i2] != NULL && 0 == strcmp(sa2[i2], ignorestr)) {
                ++i2;
            }
        }

        /* check for differing array lengths */
        if (sa2[i2] != NULL) {
            rc = -1; /* sa1 < sa2 -- fewer elements */
        } else if (sa1[i1] != NULL) {
            rc = 1; /* sa1 > sa2 -- more elements */
        }
    }

    return rc;
}

struct attr_enum_wrapper
{
    Slapi_Attr **attrs;
    int enquote_sup_oc;
    struct sizedbuffer *psbAttrTypes;
    int user_defined_only;
    int schema_ds4x_compat;
};

static int
schema_attr_enum_callback(struct asyntaxinfo *asip, void *arg)
{
    struct attr_enum_wrapper *aew = (struct attr_enum_wrapper *)arg;
    int aliaslen = 0;
    struct berval val;
    struct berval *vals[2] = {0, 0};
    const char *attr_desc, *syntaxoid;
    char *outp, syntaxlengthbuf[128];
    int i;

    vals[0] = &val;

    if (!asip) {
        slapi_log_err(SLAPI_LOG_ERR, "schema_attr_enum_callback",
                      "Error: no attribute types in schema_attr_enum_callback\n");
        return ATTR_SYNTAX_ENUM_NEXT;
    }

    if (aew->user_defined_only &&
        (asip->asi_flags & SLAPI_ATTR_FLAG_STD_ATTR)) {
        return ATTR_SYNTAX_ENUM_NEXT; /* not user defined */
    }

    if (aew->schema_ds4x_compat) {
        attr_desc = (asip->asi_flags & SLAPI_ATTR_FLAG_STD_ATTR)
                        ? ATTR_STANDARD_STRING
                        : ATTR_USERDEF_STRING;
    } else {
        attr_desc = asip->asi_desc;
    }

    if (asip->asi_aliases != NULL) {
        for (i = 0; asip->asi_aliases[i] != NULL; ++i) {
            aliaslen += strlen(asip->asi_aliases[i]);
        }
    }

    syntaxoid = asip->asi_plugin->plg_syntax_oid;

    if (!aew->schema_ds4x_compat &&
        asip->asi_syntaxlength != SLAPI_SYNTAXLENGTH_NONE) {
        /* sprintf() is safe because syntaxlengthbuf is large enough */
        sprintf(syntaxlengthbuf, "{%d}", asip->asi_syntaxlength);
    } else {
        *syntaxlengthbuf = '\0';
    }

    /*
     * XXX: 256 is a magic number... it must be big enough to account for
     * all of the fixed sized items we output.
     */
    sizedbuffer_allocate(aew->psbAttrTypes, 256 + strlen(asip->asi_oid) +
                                                strlen(asip->asi_name) +
                                                aliaslen + strlen_null_ok(attr_desc) +
                                                strlen(syntaxoid) +
                                                strlen_null_ok(asip->asi_superior) +
                                                strlen_null_ok(asip->asi_mr_equality) +
                                                strlen_null_ok(asip->asi_mr_ordering) +
                                                strlen_null_ok(asip->asi_mr_substring) +
                                                strcat_extensions(NULL, asip->asi_extensions));

    /*
     * Overall strategy is to maintain a pointer to the next location in
     * the output buffer so we can do simple strcpy's, sprintf's, etc.
     * That pointer is `outp'.  Each item that is output includes a trailing
     * space, so there is no need to include a leading one in the next item.
     */
    outp = aew->psbAttrTypes->buffer;
    outp += sprintf(outp, "( %s NAME ", asip->asi_oid);
    if (asip->asi_aliases == NULL || asip->asi_aliases[0] == NULL) {
        /* only one name */
        outp += sprintf(outp, "'%s' ", asip->asi_name);
    } else {
        /* several names */
        outp += sprintf(outp, "( '%s' ", asip->asi_name);
        for (i = 0; asip->asi_aliases[i] != NULL; ++i) {
            outp += sprintf(outp, "'%s' ", asip->asi_aliases[i]);
        }
        outp += strcpy_count(outp, ") ");
    }

    /* DESC is optional */
    if (attr_desc && *attr_desc) {
        outp += sprintf(outp, "DESC '%s'", attr_desc);
    }
    if (!aew->schema_ds4x_compat &&
        (asip->asi_flags & SLAPI_ATTR_FLAG_OBSOLETE)) {
        outp += strcpy_count(outp, schema_obsolete_with_spaces);
    } else {
        outp += strcpy_count(outp, " ");
    }

    if (!aew->schema_ds4x_compat) {
        /*
         * These values in quotes are not supported by the openldap parser.
         * Even if nsslapd-enquote-sup-oc is on, quotes should not be added.
         */
        outp += put_tagged_oid(outp, "SUP ", asip->asi_superior, NULL, 0);
        outp += put_tagged_oid(outp, "EQUALITY ", asip->asi_mr_equality, NULL, 0);
        outp += put_tagged_oid(outp, "ORDERING ", asip->asi_mr_ordering, NULL, 0);
        outp += put_tagged_oid(outp, "SUBSTR ", asip->asi_mr_substring, NULL, 0);
    }

```

[Assistant]
<<<<<<< SEARCH
    const char *attr_desc, *syntaxoid;
    char *outp, syntaxlengthbuf[128];
    int i;

    vals[0] = &val;

=======
    const char *attr_desc, *syntaxoid;
    char *outp, syntaxlengthbuf[128];
    int i;
    int nb_aliases = 0;

    vals[0] = &val;

>>>>>>> REPLACE
<<<<<<< SEARCH
    if (asip->asi_aliases != NULL) {
        for (i = 0; asip->asi_aliases[i] != NULL; ++i) {
            aliaslen += strlen(asip->asi_aliases[i]);
        }
    }

=======
    if (asip->asi_aliases != NULL) {
        for (i = 0; asip->asi_aliases[i] != NULL; ++i) {
            aliaslen += strlen(asip->asi_aliases[i]);
            nb_aliases++;
        }
    }

>>>>>>> REPLACE
<<<<<<< SEARCH
     * XXX: 256 is a magic number... it must be big enough to account for
     * all of the fixed sized items we output.
     */
    sizedbuffer_allocate(aew->psbAttrTypes, 256 + strlen(asip->asi_oid) +
                                                strlen(asip->asi_name) +
                                                aliaslen + strlen_null_ok(attr_desc) +
                                                strlen(syntaxoid) +
                                                strlen_null_ok(asip->asi_superior) +
                                                strlen_null_ok(asip->asi_mr_equality) +
                                                strlen_null_ok(asip->asi_mr_ordering) +
                                                strlen_null_ok(asip->asi_mr_substring) +
                                                strcat_extensions(NULL, asip->asi_extensions));

    /*
     * Overall strategy is to maintain a pointer to the next location in
=======
     * XXX: 256 is a magic number... it must be big enough to account for
     * all of the fixed sized items we output.
     */
    {
        int asi_oid_strlen = strlen(asip->asi_oid) + 8;      /* "( %s NAME " */
        int asi_name_strlen = strlen(asip->asi_name) + 6;    /* "( '%s' ...)" */
        int asi_aliases_strlen = aliaslen + nb_aliases * 3;  /* "'%s' " */
        int asi_desc_strlen = strlen_null_ok(attr_desc) + 7; /* "DESC '%s'" */
        int asi_syntaxoid_strlen = strlen("SYNTAX ") + strlen(syntaxoid) + strlen(syntaxlengthbuf);
        int asi_superior_strlen = strlen("SUP ") + strlen_null_ok(asip->asi_superior);
        int asi_mr_equality_strlen = strlen("EQUALITY ") + strlen_null_ok(asip->asi_mr_equality);
        int asi_mr_ordering_strlen = strlen("ORDERING ") + strlen_null_ok(asip->asi_mr_ordering);
        int asi_mr_substring_strlen = strlen("SUBSTR ") + strlen_null_ok(asip->asi_mr_substring);
        int asi_flags_strlen = strlen("SINGLE-VALUE ") +
                               strlen(schema_obsolete_with_spaces) +
                               strlen(schema_collective_with_spaces) +
                               strlen(schema_nousermod_with_spaces) +
                               strlen("USAGE distributedOperation ") +
                               strlen("USAGE dSAOperation ") +
                               strlen("USAGE directoryOperation ");
        int asi_extension_strlen = strcat_extensions(NULL, asip->asi_extensions);

        if (aew->enquote_sup_oc) {
            /* it enquote the syntax oid */
            asi_syntaxoid_strlen += 2;
        }

    sizedbuffer_allocate(aew->psbAttrTypes, 256 + asi_oid_strlen +
                                                  asi_name_strlen +
                                                  asi_aliases_strlen +
                                                  asi_desc_strlen +
                                                  asi_syntaxoid_strlen +
                                                  asi_superior_strlen +
                                                  asi_mr_equality_strlen +
                                                  asi_mr_ordering_strlen +
                                                  asi_mr_substring_strlen +
                                                  asi_extension_strlen +
                                                  asi_flags_strlen);
    }

    /*
     * Overall strategy is to maintain a pointer to the next location in
>>>>>>> REPLACE


[System]
You are a security engineer fixing a CVE. You are given the vulnerability description (symptom only) and the vulnerable source window. Author the MINIMAL fix as one or more SEARCH/REPLACE blocks. Follow these rules exactly:
1. Each block is:
<<<<<<< SEARCH
<exact lines copied verbatim from the shown source window>
=======
<the replacement lines>
>>>>>>> REPLACE
2. The SEARCH text MUST appear verbatim in the shown source window — copy it exactly, including whitespace; do not invent or paraphrase it.
3. Change as few lines as possible; keep the SEARCH span tight around the edit.
4. Modify ONLY code visible in the shown source window.
5. Output only the SEARCH/REPLACE block(s) with no other text.
6. Prefer folding a new bound or check into an existing condition over adding a separate guard, when the upstream fix does so.

[User]
# CVE
CVE-2025-31344: Heap-buffer-overflow (out-of-bounds read, CWE-125) in giflib 5.2.2's gif2rgb utility. A crafted GIF whose raster contains a color index >= the global/local palette size therefore reads past the Colors[] allocation (and the read bytes are written into the RGB output). Fix pulled into nixpkgs from the OpenMandriva patch giflib-5.2.2-cve-2025-31344 (in-tree pkgs/by-name/gi/giflib/CVE-2025-31344.patch); no upstream giflib release carries it yet, so a version bump is not possible.

# Vulnerable source (gif2rgb.c)
```c

		free((char *)Buffer);
		fclose(rgbfp[0]);
	} else {
		unsigned char *Buffers[3];

		if ((Buffers[0] = (unsigned char *)malloc(ScreenWidth)) ==
		        NULL ||
		    (Buffers[1] = (unsigned char *)malloc(ScreenWidth)) ==
		        NULL ||
		    (Buffers[2] = (unsigned char *)malloc(ScreenWidth)) ==
		        NULL) {
			GIF_EXIT(
			    "Failed to allocate memory required, aborted.");
		}

		for (i = 0; i < ScreenHeight; i++) {
			GifRow = ScreenBuffer[i];
			GifQprintf("\b\b\b\b%-4d", ScreenHeight - i);
			for (j = 0; j < ScreenWidth; j++) {
				ColorMapEntry = &ColorMap->Colors[GifRow[j]];
				Buffers[0][j] = ColorMapEntry->Red;
				Buffers[1][j] = ColorMapEntry->Green;
				Buffers[2][j] = ColorMapEntry->Blue;
			}
			if (fwrite(Buffers[0], ScreenWidth, 1, rgbfp[0]) != 1 ||
			    fwrite(Buffers[1], ScreenWidth, 1, rgbfp[1]) != 1 ||
			    fwrite(Buffers[2], ScreenWidth, 1, rgbfp[2]) != 1) {
				GIF_EXIT("Write to file(s) failed.");
			}
		}

		free((char *)Buffers[0]);
		free((char *)Buffers[1]);
		free((char *)Buffers[2]);
		fclose(rgbfp[0]);
		fclose(rgbfp[1]);
		fclose(rgbfp[2]);
	}
}
```

[Assistant]
<<<<<<< SEARCH
			GifRow = ScreenBuffer[i];
			GifQprintf("\b\b\b\b%-4d", ScreenHeight - i);
			for (j = 0; j < ScreenWidth; j++) {
				ColorMapEntry = &ColorMap->Colors[GifRow[j]];
				Buffers[0][j] = ColorMapEntry->Red;
				Buffers[1][j] = ColorMapEntry->Green;
=======
			GifRow = ScreenBuffer[i];
			GifQprintf("\b\b\b\b%-4d", ScreenHeight - i);
			for (j = 0; j < ScreenWidth; j++) {
				/* Check if color is within color palete */
				if (GifRow[j] >= ColorMap->ColorCount) {
					GIF_EXIT(GifErrorString(
					    D_GIF_ERR_IMAGE_DEFECT));
				}
				ColorMapEntry = &ColorMap->Colors[GifRow[j]];
				Buffers[0][j] = ColorMapEntry->Red;
				Buffers[1][j] = ColorMapEntry->Green;
>>>>>>> REPLACE


[System]
You are a security engineer fixing a CVE. You are given the vulnerability description (symptom only) and the vulnerable source window. Author the MINIMAL fix as one or more SEARCH/REPLACE blocks. Follow these rules exactly:
1. Each block is:
<<<<<<< SEARCH
<exact lines copied verbatim from the shown source window>
=======
<the replacement lines>
>>>>>>> REPLACE
2. The SEARCH text MUST appear verbatim in the shown source window — copy it exactly, including whitespace; do not invent or paraphrase it.
3. Change as few lines as possible; keep the SEARCH span tight around the edit.
4. Modify ONLY code visible in the shown source window.
5. Output only the SEARCH/REPLACE block(s) with no other text.
6. Prefer folding a new bound or check into an existing condition over adding a separate guard, when the upstream fix does so.

[User]
# CVE
CVE-2025-34451: Stack-based buffer overflow (CWE-121) in rofl0r/proxychains-ng <= 4.17 via `proxy_from_string()` in `src/libproxychains.c`. When parsing a proxy configuration line with an HTTP proxy that has a username or password exceeding 255 bytes, the code copies the credential into a fixed 256-byte stack buffer (`user_buf[]` / `pass_buf[]`) without bounds checking. The public PoC: run `proxychains4 -f evil.conf -- /bin/true` with evil.conf containing `http AAAA...AAA:pass@127.0.0.1 8080` where the username is >255 characters.

# Vulnerable source (src/libproxychains.c)
```c
			case '5': proxytype = RS_PT_SOCKS5; break;
			case '4': proxytype = RS_PT_SOCKS4; break;
			default: goto inv_string;
		}
	} else if(*proxystring == 'h') {
		proxytype = RS_PT_HTTP;
		next_token = 4;
	} else goto inv_string;
	if(
	   proxystring[next_token++] != ':' ||
	   proxystring[next_token++] != '/' ||
	   proxystring[next_token++] != '/') goto inv_string;
	const char *at = strrchr(proxystring+next_token, '@');
	if(at) {
		if(proxytype == RS_PT_SOCKS4)
			return 0;
		p = strchr(proxystring+next_token, ':');
		if(!p || p >= at) goto inv_string;
		const char *u = proxystring+next_token;
		ul = p-u;
		p++;
		pl = at-p;
		if(proxytype == RS_PT_SOCKS5 && (ul > 255 || pl > 255))
			return 0;
		memcpy(user_buf, u, ul);
		user_buf[ul]=0;
		memcpy(pass_buf, p, pl);
		pass_buf[pl]=0;
		next_token += 2+ul+pl;
	} else {
		user_buf[0]=0;
		pass_buf[0]=0;
	}
	const char* h = proxystring+next_token;
	p = strchr(h, ':');
	if(!p) goto inv_string;
	hl = p-h;
	if(hl > 255)
		return 0;
	memcpy(host_buf, h, hl);
```

[Assistant]
<<<<<<< SEARCH
		ul = p-u;
		p++;
		pl = at-p;
		if(proxytype == RS_PT_SOCKS5 && (ul > 255 || pl > 255))
			return 0;
		memcpy(user_buf, u, ul);
		user_buf[ul]=0;
=======
		ul = p-u;
		p++;
		pl = at-p;
		if(ul > 255 || pl > 255)
			return 0;
		memcpy(user_buf, u, ul);
		user_buf[ul]=0;
>>>>>>> REPLACE


[System]
You are a security engineer fixing a CVE. You are given the vulnerability description (symptom only) and the vulnerable source window. Author the MINIMAL fix as one or more SEARCH/REPLACE blocks. Follow these rules exactly:
1. Each block is:
<<<<<<< SEARCH
<exact lines copied verbatim from the shown source window>
=======
<the replacement lines>
>>>>>>> REPLACE
2. The SEARCH text MUST appear verbatim in the shown source window — copy it exactly, including whitespace; do not invent or paraphrase it.
3. Change as few lines as possible; keep the SEARCH span tight around the edit.
4. Modify ONLY code visible in the shown source window.
5. Output only the SEARCH/REPLACE block(s) with no other text.
6. Prefer folding a new bound or check into an existing condition over adding a separate guard, when the upstream fix does so.

[User]
# CVE
CVE-2025-46836: corosync through 3.1.9 does not validate the size of an orf_token message against the size of the preallocated storage buffer before endian conversion. A remote attacker on the corosync network segment can send a crafted oversized orf_token message, causing an out-of-bounds write into a fixed-size stack buffer and crashing the corosync daemon.

# Vulnerable source (exec/totemsrp.c)
```c

	return (transmits_allowed);
}

/*
 * don't overflow the RTR sort queue
 */
static void fcc_rtr_limit (
	struct totemsrp_instance *instance,
	struct orf_token *token,
	unsigned int *transmits_allowed)
{
	int check = QUEUE_RTR_ITEMS_SIZE_MAX;
	check -= (*transmits_allowed + instance->totem_config->window_size);
	assert (check >= 0);
	if (sq_lt_compare (instance->last_released +
		QUEUE_RTR_ITEMS_SIZE_MAX - *transmits_allowed -
		instance->totem_config->window_size,

			token->seq)) {

			*transmits_allowed = 0;
	}
}

static void fcc_token_update (
	struct totemsrp_instance *instance,
	struct orf_token *token,
	unsigned int msgs_transmitted)
{
	token->fcc += msgs_transmitted - instance->my_trc;
	token->backlog += instance->my_cbl - instance->my_pbl;
	instance->my_trc = msgs_transmitted;
	instance->my_pbl = instance->my_cbl;
}

/*
 * Sanity checkers
 */
static int check_orf_token_sanity(
	const struct totemsrp_instance *instance,
	const void *msg,
	size_t msg_len,
	int endian_conversion_needed)
{
	int rtr_entries;
	const struct orf_token *token = (const struct orf_token *)msg;
	size_t required_len;

	if (msg_len < sizeof(struct orf_token)) {
		log_printf (instance->totemsrp_log_level_security,
		    "Received orf_token message is too short...  ignoring.");

		return (-1);
	}

	if (endian_conversion_needed) {
		rtr_entries = swab32(token->rtr_list_entries);
	} else {
		rtr_entries = token->rtr_list_entries;
	}

	required_len = sizeof(struct orf_token) + rtr_entries * sizeof(struct rtr_item);
	if (msg_len < required_len) {
		log_printf (instance->totemsrp_log_level_security,
		    "Received orf_token message is too short...  ignoring.");

		return (-1);
	}

	return (0);
}

static int check_mcast_sanity(
	struct totemsrp_instance *instance,
	const void *msg,
	size_t msg_len,
	int endian_conversion_needed)
{

	if (msg_len < sizeof(struct mcast)) {
		log_printf (instance->totemsrp_log_level_security,
		    "Received mcast message is too short...  ignoring.");

		return (-1);
	}

	return (0);
}

static int check_memb_merge_detect_sanity(
	struct totemsrp_instance *instance,
	const void *msg,
	size_t msg_len,
	int endian_conversion_needed)
{

	if (msg_len < sizeof(struct memb_merge_detect)) {
		log_printf (instance->totemsrp_log_level_security,
		    "Received memb_merge_detect message is too short...  ignoring.");

		return (-1);
	}

	return (0);
}

static int check_memb_join_sanity(
	struct totemsrp_instance *instance,
	const void *msg,
	size_t msg_len,
	int endian_conversion_needed)
{
	const struct memb_join *mj_msg = (const struct memb_join *)msg;
	unsigned int proc_list_entries;
	unsigned int failed_list_entries;
	size_t required_len;

	if (msg_len < sizeof(struct memb_join)) {
		log_printf (instance->totemsrp_log_level_security,
		    "Received memb_join message is too short...  ignoring.");

		return (-1);
	}

	proc_list_entries = mj_msg->proc_list_entries;
	failed_list_entries = mj_msg->failed_list_entries;

	if (endian_conversion_needed) {
		proc_list_entries = swab32(proc_list_entries);
		failed_list_entries = swab32(failed_list_entries);
	}

	required_len = sizeof(struct memb_join) + ((proc_list_entries + failed_list_entries) * sizeof(struct srp_addr));
	if (msg_len < required_len) {
		log_printf (instance->totemsrp_log_level_security,
		    "Received memb_join message is too short...  ignoring.");

		return (-1);
	}

	return (0);
}

static int check_memb_commit_token_sanity(
	struct totemsrp_instance *instance,
	const void *msg,
	size_t msg_len,
	int endian_conversion_needed)
{
	const struct memb_commit_token *mct_msg = (const struct memb_commit_token *)msg;
	unsigned int addr_entries;
	size_t required_len;

	if (msg_len < sizeof(struct memb_commit_token)) {
		log_printf (instance->totemsrp_log_level_security,
		    "Received memb_commit_token message is too short...  ignoring.");

		return (0);
	}

	addr_entries= mct_msg->addr_entries;
	if (endian_conversion_needed) {
		addr_entries = swab32(addr_entries);
	}

	required_len = sizeof(struct memb_commit_token) +
	    (addr_entries * (sizeof(struct srp_addr) + sizeof(struct memb_commit_token_memb_entry)));
	if (msg_len < required_len) {
		log_printf (instance->totemsrp_log_level_security,
		    "Received memb_commit_token message is too short...  ignoring.");

		return (-1);
	}

	return (0);
}

static int check_token_hold_cancel_sanity(
	struct totemsrp_instance *instance,
	const void *msg,
	size_t msg_len,
	int endian_conversion_needed)
{

	if (msg_len < sizeof(struct token_hold_cancel)) {
		log_printf (instance->totemsrp_log_level_security,
		    "Received token_hold_cancel message is too short...  ignoring.");

		return (-1);
	}

	return (0);
}

/*
 * Message Handlers
 */

#ifdef GIVEINFO
uint64_t tv_old;
#endif
/*
 * message handler called when TOKEN message type received
 */
static int message_handler_orf_token (
	struct totemsrp_instance *instance,
	const void *msg,
	size_t msg_len,
	int endian_conversion_needed)
{
	char token_storage[1500];
	char token_convert[1500];
	struct orf_token *token = NULL;
	int forward_token;
	unsigned int transmits_allowed;
	unsigned int mcasted_retransmit;
	unsigned int mcasted_regular;
	unsigned int last_aru;

#ifdef GIVEINFO
	uint64_t tv_current;
	uint64_t tv_diff;

	tv_current = qb_util_nano_current_get ();
	tv_diff = tv_current - tv_old;
	tv_old = tv_current;

	log_printf (instance->totemsrp_log_level_debug,
	    "Time since last token %0.4f ms", tv_diff / (float)QB_TIME_NS_IN_MSEC);
#endif

	if (check_orf_token_sanity(instance, msg, msg_len, endian_conversion_needed) == -1) {
		return (0);
	}

	if (instance->orf_token_discard) {
		return (0);
	}
#ifdef TEST_DROP_ORF_TOKEN_PERCENTAGE
	if (random()%100 < TEST_DROP_ORF_TOKEN_PERCENTAGE) {
		return (0);
	}
#endif

	if (endian_conversion_needed) {
		orf_token_endian_convert ((struct orf_token *)msg,
			(struct orf_token *)token_convert);
		msg = (struct orf_token *)token_convert;
	}

	/*
	 * Make copy of token and retransmit list in case we have
	 * to flush incoming messages from the kernel queue
	 */
	token = (struct orf_token *)token_storage;
	memcpy (token, msg, sizeof (struct orf_token));
	memcpy (&token->rtr_list[0], (char *)msg + sizeof (struct orf_token),
		sizeof (struct rtr_item) * RETRANSMIT_ENTRIES_MAX);

	/*
	 * Handle merge detection timeout
	 */
	if (token->seq == instance->my_last_seq) {
		start_merge_detect_timeout (instance);
		instance->my_seq_unchanged += 1;
	} else {
		cancel_merge_detect_timeout (instance);
		cancel_token_hold_retransmit_timeout (instance);
		instance->my_seq_unchanged = 0;
	}

	instance->my_last_seq = token->seq;

#ifdef TEST_RECOVERY_MSG_COUNT
```

[Assistant]
<<<<<<< SEARCH
	const struct totemsrp_instance *instance,
	const void *msg,
	size_t msg_len,
	int endian_conversion_needed)
{
	int rtr_entries;
	const struct orf_token *token = (const struct orf_token *)msg;
	size_t required_len;

	if (msg_len < sizeof(struct orf_token)) {
		log_printf (instance->totemsrp_log_level_security,
		    "Received orf_token message is too short...  ignoring.");
=======
	const struct totemsrp_instance *instance,
	const void *msg,
	size_t msg_len,
	size_t max_msg_len,
	int endian_conversion_needed)
{
	int rtr_entries;
	const struct orf_token *token = (const struct orf_token *)msg;
	size_t required_len;

	if (msg_len > max_msg_len) {
		log_printf (instance->totemsrp_log_level_security,
		    "Received orf_token message is too long...  ignoring.");

		return (-1);
	}

	if (msg_len < sizeof(struct orf_token)) {
		log_printf (instance->totemsrp_log_level_security,
		    "Received orf_token message is too short...  ignoring.");
>>>>>>> REPLACE
<<<<<<< SEARCH
		rtr_entries = token->rtr_list_entries;
	}

	required_len = sizeof(struct orf_token) + rtr_entries * sizeof(struct rtr_item);
	if (msg_len < required_len) {
		log_printf (instance->totemsrp_log_level_security,
=======
		rtr_entries = token->rtr_list_entries;
	}

	if (rtr_entries > RETRANSMIT_ENTRIES_MAX) {
		log_printf (instance->totemsrp_log_level_security,
		    "Received orf_token message rtr_entries is corrupted...  ignoring.");

		return (-1);
	}

	required_len = sizeof(struct orf_token) + rtr_entries * sizeof(struct rtr_item);
	if (msg_len < required_len) {
		log_printf (instance->totemsrp_log_level_security,
>>>>>>> REPLACE
<<<<<<< SEARCH
	    "Time since last token %0.4f ms", tv_diff / (float)QB_TIME_NS_IN_MSEC);
#endif

	if (check_orf_token_sanity(instance, msg, msg_len, endian_conversion_needed) == -1) {
		return (0);
	}
=======
	    "Time since last token %0.4f ms", tv_diff / (float)QB_TIME_NS_IN_MSEC);
#endif

	if (check_orf_token_sanity(instance, msg, msg_len, sizeof(token_storage),
	    endian_conversion_needed) == -1) {
		return (0);
	}
>>>>>>> REPLACE


[System]
You are a security engineer fixing a CVE. You are given the vulnerability description (symptom only) and the vulnerable source window. Author the MINIMAL fix as one or more SEARCH/REPLACE blocks. Follow these rules exactly:
1. Each block is:
<<<<<<< SEARCH
<exact lines copied verbatim from the shown source window>
=======
<the replacement lines>
>>>>>>> REPLACE
2. The SEARCH text MUST appear verbatim in the shown source window — copy it exactly, including whitespace; do not invent or paraphrase it.
3. Change as few lines as possible; keep the SEARCH span tight around the edit.
4. Modify ONLY code visible in the shown source window.
5. Output only the SEARCH/REPLACE block(s) with no other text.
6. Prefer folding a new bound or check into an existing condition over adding a separate guard, when the upstream fix does so.

[User]
# CVE
CVE-2025-47256: Stack-based buffer underwrite (CWE-191 integer underflow → CWE-121 stack buffer overflow) in libxmp's Pha Packer loader. In loaders/prowizard/pha.c, the depack_pha() function iterates over compressed blocks using a counter ocpt whose value comes directly from the module file. When ocpt is sufficiently large, the expression used as an array subscript wraps below zero (signed integer underflow), causing writes to memory below the dest buffer's base — a stack buffer underwrite. A crafted .mod file with an overflowed ocpt field triggers a SIGSEGV on any caller of xmp_load_module(). Upstream ships test fixtures: test-dev/data/f/prowizard_pha_invalid_ocpt and prowizard_pha_invalid_ocpt2.

# Vulnerable source (src/loaders/prowizard/pha.c)
```c
/* ProWizard
 * Copyright (C) 1996-1999 Asle / ReDoX
 * Modified in 2006,2007,2014 by Claudio Matsuoka
 * Modified in 2021 by Alice Rowan
 *
 * Permission is hereby granted, free of charge, to any person obtaining a
 * copy of this software and associated documentation files (the "Software"),
 * to deal in the Software without restriction, including without limitation
 * the rights to use, copy, modify, merge, publish, distribute, sublicense,
 * and/or sell copies of the Software, and to permit persons to whom the
 * Software is furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
        /* ... */
				paddr1[j] = paddr1[i];
				paddr1[i] = tmp;
				goto restart;
			}
		}
	}

	j = 0;
	for (i = 0; i < 128; i++) {
		if (i == 0) {
			paddr2[j] = paddr1[i];
			continue;
		}

		if (paddr1[i] == paddr2[j])
			continue;
		paddr2[++j] = paddr1[i];
	}

	/* try to take care of unused patterns ... HARRRRRRD */
	memset(paddr1, 0, sizeof(paddr1));
	j = 0;
	k = paddr[0];
	/* 120 ... leaves 8 unused ptk_tableible patterns .. */
	for (i = 0; i < 120; i++) {
		paddr1[j] = paddr2[i];
		j += 1;
		if (j >= 128)
			break;

		if ((paddr2[i + 1] - paddr2[i]) > 1024) {
			paddr1[j] = paddr2[i] + 1024;
			j += 1;
			if (j >= 128)
				break;
		}
	}

	for (c1 = 0; c1 < 128; c1++) {
		for (c2 = 0; c2 < 128; c2++) {
        /* ... */
#if 0
	j = ftell (in);
	fseek (in, 0, 2);	/* SEEK_END */
	psize = ftell (in) - j;
	fseek (in, j, 0);	/* SEEK_SET */
#endif
	/* This value should be larger than the actual size of the
	 * pattern data and will probably set the error flag, so
	 * clear it after reading.
	 */
	psize = npat * 1024;
	if ((pdata = (uint8 *)malloc(psize)) == NULL)
		return -1;

	psize = hio_read(pdata, 1, psize, in);
	hio_error(in);

	size = npat * 1024;
	if ((pat = (uint8 *)calloc(1, size)) == NULL)
		goto err;

	j = 0;
	for (i = 0; i < psize && j < size; i++) {
		if (pdata[i] == 0xff) {
			i += 1;
			if (i >= psize)
				goto err;

			ocpt[(k + 3) % 4] = 0xff - pdata[i];
			continue;
		}
		if (ocpt[k % 4] != 0) {
			ins = onote[k % 4][0];
			note = onote[k % 4][1];
			fxt = onote[k % 4][2];
			fxp = onote[k % 4][3];
			ocpt[k % 4] -= 1;

			pat[j] = ins & 0xf0;
			if (PTK_IS_VALID_NOTE(note / 2)) {
```

[Assistant]
<<<<<<< SEARCH
/* ProWizard
 * Copyright (C) 1996-1999 Asle / ReDoX
 * Modified in 2006,2007,2014 by Claudio Matsuoka
 * Modified in 2021 by Alice Rowan
 *
 * Permission is hereby granted, free of charge, to any person obtaining a
 * copy of this software and associated documentation files (the "Software"),
=======
/* ProWizard
 * Copyright (C) 1996-1999 Asle / ReDoX
 * Modified in 2006,2007,2014 by Claudio Matsuoka
 * Modified in 2021, 2025 by Alice Rowan
 *
 * Permission is hereby granted, free of charge, to any person obtaining a
 * copy of this software and associated documentation files (the "Software"),
>>>>>>> REPLACE
<<<<<<< SEARCH
	/* try to take care of unused patterns ... HARRRRRRD */
	memset(paddr1, 0, sizeof(paddr1));
	j = 0;
	k = paddr[0];
	/* 120 ... leaves 8 unused ptk_tableible patterns .. */
	for (i = 0; i < 120; i++) {
		paddr1[j] = paddr2[i];
=======
	/* try to take care of unused patterns ... HARRRRRRD */
	memset(paddr1, 0, sizeof(paddr1));
	j = 0;
	/* 120 ... leaves 8 unused ptk_tableible patterns .. */
	for (i = 0; i < 120; i++) {
		paddr1[j] = paddr2[i];
>>>>>>> REPLACE
<<<<<<< SEARCH
		goto err;

	j = 0;
	for (i = 0; i < psize && j < size; i++) {
		if (pdata[i] == 0xff) {
			i += 1;
=======
		goto err;

	j = 0;
	k = 0;
	for (i = 0; i < psize && j < size; i++) {
		if (pdata[i] == 0xff) {
			i += 1;
>>>>>>> REPLACE


[System]
You are a security engineer fixing a CVE. You are given the vulnerability description (symptom only) and the vulnerable source window. Author the MINIMAL fix as one or more SEARCH/REPLACE blocks. Follow these rules exactly:
1. Each block is:
<<<<<<< SEARCH
<exact lines copied verbatim from the shown source window>
=======
<the replacement lines>
>>>>>>> REPLACE
2. The SEARCH text MUST appear verbatim in the shown source window — copy it exactly, including whitespace; do not invent or paraphrase it.
3. Change as few lines as possible; keep the SEARCH span tight around the edit.
4. Modify ONLY code visible in the shown source window.
5. Output only the SEARCH/REPLACE block(s) with no other text.
6. Prefer folding a new bound or check into an existing condition over adding a separate guard, when the upstream fix does so.

[User]
# CVE
CVE-2025-48060: Heap buffer overflow (CWE-122) in jq 1.7.1 and earlier in the string-formatting path. via `0[[]|implode]`) reads one byte past the allocation boundary, causing a heap buffer overflow. A crafted jq program or input that triggers the `implode`-of-empty-array path can crash jq or, under adversarial heap layout, leak or corrupt adjacent heap memory.

# Vulnerable source (src/jv.c)
```c
  length = out - s->data;
  s->data[length] = 0;
  s->length_hashed = length << 1;
  jv r = {JVP_FLAGS_STRING, 0, 0, 0, {&s->refcnt}};
  return r;
}

/* Assumes valid UTF8 */
static jv jvp_string_new(const char* data, uint32_t length) {
  jvp_string* s = jvp_string_alloc(length);
  s->length_hashed = length << 1;
  if (data != NULL)
    memcpy(s->data, data, length);
  s->data[length] = 0;
  jv r = {JVP_FLAGS_STRING, 0, 0, 0, {&s->refcnt}};
  return r;
}

static jv jvp_string_empty_new(uint32_t length) {
  jvp_string* s = jvp_string_alloc(length);
  s->length_hashed = 0;
  memset(s->data, 0, length);
  jv r = {JVP_FLAGS_STRING, 0, 0, 0, {&s->refcnt}};
  return r;
}

static void jvp_string_free(jv js) {
  jvp_string* s = jvp_string_ptr(js);
  if (jvp_refcnt_dec(&s->refcnt)) {
    jv_mem_free(s);
  }
}

static uint32_t jvp_string_length(jvp_string* s) {
  return s->length_hashed >> 1;
}

static uint32_t jvp_string_remaining_space(jvp_string* s) {
  assert(s->alloc_length >= jvp_string_length(s));
```

[Assistant]
<<<<<<< SEARCH
  jvp_string* s = jvp_string_alloc(length);
  s->length_hashed = 0;
  memset(s->data, 0, length);
  jv r = {JVP_FLAGS_STRING, 0, 0, 0, {&s->refcnt}};
  return r;
}
=======
  jvp_string* s = jvp_string_alloc(length);
  s->length_hashed = 0;
  memset(s->data, 0, length);
  s->data[length] = 0;
  jv r = {JVP_FLAGS_STRING, 0, 0, 0, {&s->refcnt}};
  return r;
}
>>>>>>> REPLACE


[System]
You are a security engineer fixing a CVE. You are given the vulnerability description (symptom only) and the vulnerable source window. Author the MINIMAL fix as one or more SEARCH/REPLACE blocks. Follow these rules exactly:
1. Each block is:
<<<<<<< SEARCH
<exact lines copied verbatim from the shown source window>
=======
<the replacement lines>
>>>>>>> REPLACE
2. The SEARCH text MUST appear verbatim in the shown source window — copy it exactly, including whitespace; do not invent or paraphrase it.
3. Change as few lines as possible; keep the SEARCH span tight around the edit.
4. Modify ONLY code visible in the shown source window.
5. Output only the SEARCH/REPLACE block(s) with no other text.
6. Prefer folding a new bound or check into an existing condition over adding a separate guard, when the upstream fix does so.

[User]
# CVE
CVE-2025-49466: This could be exploited to cause a denial of service when the intermediate directory was absent, or to write files outside the intended temporary folder.

# Vulnerable source (commands/msgview/open.go)
```go
package msgview

import (
	"errors"
	"io"
	"mime"
	"os"
	"path/filepath"

	"git.sr.ht/~rjarry/aerc/app"
	"git.sr.ht/~rjarry/aerc/commands"
	"git.sr.ht/~rjarry/aerc/lib"
	"git.sr.ht/~rjarry/aerc/lib/log"
)

type Open struct {
	Delete bool   `opt:"-d" desc:"Delete temp file after the opener exits."`
	Cmd    string `opt:"..." required:"false"`
}

func init() {
	commands.Register(Open{})
}

func (Open) Description() string {
	return "Save the current message part to a temporary file, then open it."
}

func (Open) Context() commands.CommandContext {
	return commands.MESSAGE_VIEWER
}

func (Open) Aliases() []string {
	return []string{"open"}
}

func (o Open) Execute(args []string) error {
	mv := app.SelectedTabContent().(*app.MessageViewer)
	if mv == nil {
		return errors.New("open only supported selected message parts")
	}
	p := mv.SelectedMessagePart()

	mv.MessageView().FetchBodyPart(p.Index, func(reader io.Reader) {
		mimeType := ""

		part, err := mv.MessageView().BodyStructure().PartAtIndex(p.Index)
		if err != nil {
			app.PushError(err.Error())
			return
		}
		mimeType = part.FullMIMEType()

		tmpDir, err := os.MkdirTemp(os.TempDir(), "aerc-*")
		if err != nil {
			app.PushError(err.Error())
			return
		}
		filename := part.FileName()
		var tmpFile *os.File
		if filename == "" {
			extension := ""
			if exts, _ := mime.ExtensionsByType(mimeType); len(exts) > 0 {
				extension = exts[0]
			}
			tmpFile, err = os.CreateTemp(tmpDir, "aerc-*"+extension)
		} else {
			tmpFile, err = os.Create(filepath.Join(tmpDir, filename))
		}
		if err != nil {
			app.PushError(err.Error())
			return
		}

		_, err = io.Copy(tmpFile, reader)
		tmpFile.Close()
		if err != nil {
			app.PushError(err.Error())
			return
		}

		go func() {
			defer log.PanicHandler()
			if o.Delete {
				defer os.RemoveAll(tmpDir)
			}
			err = lib.XDGOpenMime(tmpFile.Name(), mimeType, o.Cmd)
			if err != nil {
				app.PushError("open: " + err.Error())
			}
		}()
	})

	return nil
}
```

[Assistant]
<<<<<<< SEARCH
	"io"
	"mime"
	"os"
	"path/filepath"

	"git.sr.ht/~rjarry/aerc/app"
=======
	"io"
	"mime"
	"os"
	"path"
	"path/filepath"

	"git.sr.ht/~rjarry/aerc/app"
>>>>>>> REPLACE
<<<<<<< SEARCH
			app.PushError(err.Error())
			return
		}
		filename := part.FileName()
		var tmpFile *os.File
		if filename == "" {
			extension := ""
=======
			app.PushError(err.Error())
			return
		}
		filename := path.Base(part.FileName())
		var tmpFile *os.File
		if filename == "" {
			extension := ""
>>>>>>> REPLACE


[System]
You are a security engineer fixing a CVE. You are given the vulnerability description (symptom only) and the vulnerable source window. Author the MINIMAL fix as one or more SEARCH/REPLACE blocks. Follow these rules exactly:
1. Each block is:
<<<<<<< SEARCH
<exact lines copied verbatim from the shown source window>
=======
<the replacement lines>
>>>>>>> REPLACE
2. The SEARCH text MUST appear verbatim in the shown source window — copy it exactly, including whitespace; do not invent or paraphrase it.
3. Change as few lines as possible; keep the SEARCH span tight around the edit.
4. Modify ONLY code visible in the shown source window.
5. Output only the SEARCH/REPLACE block(s) with no other text.
6. Prefer folding a new bound or check into an existing condition over adding a separate guard, when the upstream fix does so.

[User]
# CVE
CVE-2025-5278: Heap-buffer-overflow (out-of-bounds read, CWE-127/CWE-823) in GNU coreutils 9.7 `sort`. PoC (from coreutils NEWS): `sort +0.18446744073709551615R input` on 64-bit systems induces a read 1 byte before an allocated heap buffer.

# Vulnerable source (src/sort.c)
```c
      {
        while (ptr < lim && *ptr != tab)
          ++ptr;
        if (ptr < lim)
          ++ptr;
      }
  else
    while (ptr < lim && sword--)
      {
        while (ptr < lim && blanks[to_uchar (*ptr)])
          ++ptr;
        while (ptr < lim && !blanks[to_uchar (*ptr)])
          ++ptr;
      }

  /* If we're ignoring leading blanks when computing the Start
     of the field, skip past them here.  */
  if (key->skipsblanks)
    while (ptr < lim && blanks[to_uchar (*ptr)])
      ++ptr;

  /* Advance PTR by SCHAR (if possible), but no further than LIM.  */
  ptr = MIN (lim, ptr + schar);

  return ptr;
}

/* Return the limit of (a pointer to the first character after) the field
   in LINE specified by KEY. */

ATTRIBUTE_PURE
static char *
limfield (struct line const *line, struct keyfield const *key)
{
  char *ptr = line->text, *lim = ptr + line->length - 1;
  size_t eword = key->eword, echar = key->echar;

  if (echar == 0)
    eword++; /* Skip all of end field.  */

        /* ... */
    }
  else
    {
      char *newlim;
      newlim = ptr;
      while (newlim < lim && blanks[to_uchar (*newlim)])
        ++newlim;
      while (newlim < lim && !blanks[to_uchar (*newlim)])
        ++newlim;
      lim = newlim;
    }
#endif

  if (echar != 0) /* We need to skip over a portion of the end field.  */
    {
      /* If we're ignoring leading blanks when computing the End
         of the field, skip past them here.  */
      if (key->skipeblanks)
        while (ptr < lim && blanks[to_uchar (*ptr)])
          ++ptr;

      /* Advance PTR by ECHAR (if possible), but no further than LIM.  */
      ptr = MIN (lim, ptr + echar);
    }

  return ptr;
}

/* Fill BUF reading from FP, moving buf->left bytes from the end
   of buf->buf to the beginning first.  If EOF is reached and the
   file wasn't terminated by a newline, supply one.  Set up BUF's line
   table too.  FILE is the name of the file corresponding to FP.
   Return true if some input was read.  */

static bool
fillbuf (struct buffer *buf, FILE *fp, char const *file)
{
  struct keyfield const *key = keylist;
  char eol = eolchar;
  size_t line_bytes = buf->line_bytes;
```

[Assistant]
<<<<<<< SEARCH
      ++ptr;

  /* Advance PTR by SCHAR (if possible), but no further than LIM.  */
  ptr = MIN (lim, ptr + schar);

  return ptr;
}
=======
      ++ptr;

  /* Advance PTR by SCHAR (if possible), but no further than LIM.  */
  size_t remaining_bytes = lim - ptr;
  if (schar < remaining_bytes)
    ptr += schar;
  else
    ptr = lim;

  return ptr;
}
>>>>>>> REPLACE
<<<<<<< SEARCH
          ++ptr;

      /* Advance PTR by ECHAR (if possible), but no further than LIM.  */
      ptr = MIN (lim, ptr + echar);
    }

  return ptr;
=======
          ++ptr;

      /* Advance PTR by ECHAR (if possible), but no further than LIM.  */
      size_t remaining_bytes = lim - ptr;
      if (echar < remaining_bytes)
        ptr += echar;
      else
        ptr = lim;
    }

  return ptr;
>>>>>>> REPLACE


[System]
You are a security engineer fixing a CVE. You are given the vulnerability description (symptom only) and the vulnerable source window. Author the MINIMAL fix as one or more SEARCH/REPLACE blocks. Follow these rules exactly:
1. Each block is:
<<<<<<< SEARCH
<exact lines copied verbatim from the shown source window>
=======
<the replacement lines>
>>>>>>> REPLACE
2. The SEARCH text MUST appear verbatim in the shown source window — copy it exactly, including whitespace; do not invent or paraphrase it.
3. Change as few lines as possible; keep the SEARCH span tight around the edit.
4. Modify ONLY code visible in the shown source window.
5. Output only the SEARCH/REPLACE block(s) with no other text.
6. Prefer folding a new bound or check into an existing condition over adding a separate guard, when the upstream fix does so.

[User]
# CVE
CVE-2025-57812: Processing such TIFF files triggers out-of-bounds memory access and heap buffer overflows in the TIFF reading code, exploitable via crafted print jobs sent to a CUPS server.

# Vulnerable source (cupsfilters/image-tiff.c)
```c
#  include <tiff.h>	// TIFF image definitions
#  include <tiffio.h>
#  include <unistd.h>

//
// '_cfImageReadTIFF()' - Read a TIFF image file.
//

int					// O - Read status
_cfImageReadTIFF(
    cf_image_t      *img,		// IO - Image
    FILE            *fp,		// I - Image file
    cf_icspace_t    primary,		// I - Primary choice for colorspace
    cf_icspace_t    secondary,		// I - Secondary choice for colorspace
    int             saturation,		// I - Color saturation (%)
    int             hue,		// I - Color hue (degrees)
    const cf_ib_t   *lut)		// I - Lookup table for gamma/brightness
{
  TIFF		*tif;			// TIFF file
  uint32_t	width, height;		// Size of image
  uint16_t	photometric,		// Colorspace
		compression,		// Type of compression
		orientation,		// Orientation
		resunit,		// Units for resolution
		samples,		// Number of samples/pixel
		bits,			// Number of bits/pixel
		inkset,			// Ink set for color separations
		numinks;		// Number of inks in set
  float		xres,			// Horizontal resolution
		yres;			// Vertical resolution
  uint16_t	*redcmap,		// Red colormap information
		*greencmap,		// Green colormap information
		*bluecmap;		// Blue colormap information
  int		c,			// Color index
		num_colors,		// Number of colors
		bpp,			// Bytes per pixel
		x, y,			// Current x & y
		row,			// Current row in image
		xstart, ystart,		// Starting x & y
        /* ... */
    DEBUG_puts("DEBUG: No image width tag in the file!\n");
    TIFFClose(tif);
    fclose(fp);
    return (-1);
  }

  if (!TIFFGetField(tif, TIFFTAG_IMAGELENGTH, &height))
  {
    DEBUG_puts("DEBUG: No image height tag in the file!\n");
    TIFFClose(tif);
    fclose(fp);
    return (-1);
  }

  if (!TIFFGetField(tif, TIFFTAG_PHOTOMETRIC, &photometric))
  {
    DEBUG_puts("DEBUG: No photometric tag in the file!\n");
    TIFFClose(tif);
    fclose(fp);
    return (-1);
  }

  if (!TIFFGetField(tif, TIFFTAG_COMPRESSION, &compression))
  {
    DEBUG_puts("DEBUG: No compression tag in the file!\n");
    TIFFClose(tif);
    fclose(fp);
    return (-1);
  }

  if (!TIFFGetField(tif, TIFFTAG_SAMPLESPERPIXEL, &samples))
    samples = 1;

  if (!TIFFGetField(tif, TIFFTAG_BITSPERSAMPLE, &bits))
    bits = 1;

  //
  // Get the image orientation...
  //

  if (!TIFFGetField(tif, TIFFTAG_ORIENTATION, &orientation))
    orientation = 0;

  //
  // Get the image resolution...
  //

  int temp = -1;

#ifdef HAVE_EXIF
  //
  // Scan image file for EXIF data
  //

        /* ... */

    if (img->xppi == 0 || img->yppi == 0)
    {
      DEBUG_puts("DEBUG: Bad TIFF resolution.\n");
      img->xppi = img->yppi = 128;
    }

    DEBUG_printf(("DEBUG: TIFF resolution = %fx%f, units=%d\n",
		  xres, yres, resunit));
    DEBUG_printf(("DEBUG: Stored resolution = %dx%d PPI\n",
		  img->xppi, img->yppi));
  }

  //
  // See if the image has an alpha channel...
  //

  if (samples == 2 || (samples == 4 && photometric == PHOTOMETRIC_RGB))
    alpha = 1;
  else
    alpha = 0;

  //
  // Check the size of the image...
  //

  if (width == 0 || width > CF_IMAGE_MAX_WIDTH ||
      height == 0 || height > CF_IMAGE_MAX_HEIGHT ||
      (bits != 1 && bits != 2 && bits != 4 && bits != 8) ||
      samples < 1 || samples > 4)
  {
    DEBUG_printf(("DEBUG: Bad TIFF dimensions %ux%ux%ux%u!\n",
		  (unsigned)width, (unsigned)height, (unsigned)bits,
		  (unsigned)samples));
    TIFFClose(tif);
    fclose(fp);
    return (1);
  }

  //
        /* ... */
        break;
    default :
    case ORIENTATION_TOPLEFT :
        DEBUG_puts("DEBUG: orientation = top-left\n");
        break;
    case ORIENTATION_LEFTTOP :
        DEBUG_puts("DEBUG: orientation = left-top\n");
        break;
    case ORIENTATION_BOTLEFT :
        DEBUG_puts("DEBUG: orientation = bottom-left\n");
        break;
    case ORIENTATION_LEFTBOT :
        DEBUG_puts("DEBUG: orientation = left-bottom\n");
        break;
    case ORIENTATION_BOTRIGHT :
        DEBUG_puts("DEBUG: orientation = bottom-right\n");
        break;
    case ORIENTATION_RIGHTBOT :
        DEBUG_puts("DEBUG: orientation = right-bottom\n");
        break;
  }

  switch (orientation)
  {
    case ORIENTATION_TOPRIGHT :
    case ORIENTATION_RIGHTTOP :
        xstart = img->xsize - 1;
        xdir   = -1;
        ystart = 0;
        ydir   = 1;
        break;
    default :
    case ORIENTATION_TOPLEFT :
    case ORIENTATION_LEFTTOP :
        xstart = 0;
        xdir   = 1;
        ystart = 0;
        ydir   = 1;
        break;
    case ORIENTATION_BOTLEFT :
        /* ... */
	      {
		default :
		    break;

		case CF_IMAGE_WHITE :
		    cfImageRGBToWhite(in, out, img->xsize);
		    break;
		case CF_IMAGE_RGB :
		    cfImageRGBToRGB(in, out, img->xsize);
		    break;
		case CF_IMAGE_BLACK :
		    cfImageRGBToBlack(in, out, img->xsize);
		    break;
		case CF_IMAGE_CMY :
		    cfImageRGBToCMY(in, out, img->xsize);
		    break;
		case CF_IMAGE_CMYK :
		    cfImageRGBToCMYK(in, out, img->xsize);
		    break;
	      }

	      if (lut)
	        cfImageLut(out, img->xsize * 3, lut);

              _cfImagePutRow(img, 0, y, img->xsize, out);
            }
          }
          else
          {
	    //
	    // Column major order...
	    //

            for (x = xstart, xcount = img->xsize, row = 0;
        	 xcount > 0;
        	 xcount --, x += xdir, row ++)
            {
              if (bits == 1)
              {
        	TIFFReadScanline(tif, scanline, row, 0);
```

[Assistant]
<<<<<<< SEARCH
  TIFF		*tif;			// TIFF file
  uint32_t	width, height;		// Size of image
  uint16_t	photometric,		// Colorspace
		compression,		// Type of compression
		orientation,		// Orientation
		resunit,		// Units for resolution
=======
  TIFF		*tif;			// TIFF file
  uint32_t	width, height;		// Size of image
  uint16_t	photometric,		// Colorspace
    planar,         // Color components in separate planes
		compression,		// Type of compression
		orientation,		// Orientation
		resunit,		// Units for resolution
>>>>>>> REPLACE
<<<<<<< SEARCH
    return (-1);
  }

  if (!TIFFGetField(tif, TIFFTAG_COMPRESSION, &compression))
  {
    DEBUG_puts("DEBUG: No compression tag in the file!\n");
=======
    return (-1);
  }

  if (TIFFGetField(tif, TIFFTAG_PLANARCONFIG, &planar) &&
      planar == PLANARCONFIG_SEPARATE)
  {
    fputs("DEBUG: Images with planar color configuration are not supported!\n", stderr);
    TIFFClose(tif);
    fclose(fp);
    return (1);
  }

  if (!TIFFGetField(tif, TIFFTAG_COMPRESSION, &compression))
  {
    DEBUG_puts("DEBUG: No compression tag in the file!\n");
>>>>>>> REPLACE
<<<<<<< SEARCH
  if (!TIFFGetField(tif, TIFFTAG_BITSPERSAMPLE, &bits))
    bits = 1;

  //
  // Get the image orientation...
  //
=======
  if (!TIFFGetField(tif, TIFFTAG_BITSPERSAMPLE, &bits))
    bits = 1;

  if (bits == 1 && samples > 1)
  {
    fprintf(stderr, "ERROR: Color images with 1 bit per sample not supported! "
                    "Samples per pixel: %d; Bits per sample: %d\n", samples, bits);
    TIFFClose(tif);
    fclose(fp);
    return (1);
  }

  //
  // Get the image orientation...
  //
>>>>>>> REPLACE
<<<<<<< SEARCH
  else
    alpha = 0;

  //
  // Check the size of the image...
  //
=======
  else
    alpha = 0;

  //
  // Check whether number of samples per pixel corresponds with color space
  //

  if ((photometric == PHOTOMETRIC_RGB && (samples < 3 || samples > 4)) ||
      (photometric == PHOTOMETRIC_SEPARATED && samples != 4))
  {
    fprintf(stderr, "DEBUG: Number of samples per pixel does not correspond to color space! "
                    "Color space: %s; Samples per pixel: %d\n",
                    (photometric == PHOTOMETRIC_RGB ? "RGB" :
                     (photometric == PHOTOMETRIC_SEPARATED ? "CMYK" : "Unknown")),
                    samples);
    TIFFClose(tif);
    fclose(fp);
    return (1);
  }

  //
  // Check the size of the image...
  //
>>>>>>> REPLACE
<<<<<<< SEARCH
        break;
  }

  switch (orientation)
  {
    case ORIENTATION_TOPRIGHT :
=======
        break;
  }

  if (orientation >= ORIENTATION_LEFTTOP)
  {
    fputs("ERROR: TIFF files with vertical scanlines are not supported!\n", stderr);
    TIFFClose(tif);
    fclose(fp);
    return (-1);
  }

  switch (orientation)
  {
    case ORIENTATION_TOPRIGHT :
>>>>>>> REPLACE
<<<<<<< SEARCH
	      }

	      if (lut)
	        cfImageLut(out, img->xsize * 3, lut);

              _cfImagePutRow(img, 0, y, img->xsize, out);
            }
=======
	      }

	      if (lut)
	        cfImageLut(out, img->xsize * bpp, lut);

              _cfImagePutRow(img, 0, y, img->xsize, out);
            }
>>>>>>> REPLACE


[System]
You are a security engineer fixing a CVE. You are given the vulnerability description (symptom only) and the vulnerable source window. Author the MINIMAL fix as one or more SEARCH/REPLACE blocks. Follow these rules exactly:
1. Each block is:
<<<<<<< SEARCH
<exact lines copied verbatim from the shown source window>
=======
<the replacement lines>
>>>>>>> REPLACE
2. The SEARCH text MUST appear verbatim in the shown source window — copy it exactly, including whitespace; do not invent or paraphrase it.
3. Change as few lines as possible; keep the SEARCH span tight around the edit.
4. Modify ONLY code visible in the shown source window.
5. Output only the SEARCH/REPLACE block(s) with no other text.
6. Prefer folding a new bound or check into an existing condition over adding a separate guard, when the upstream fix does so.

[User]
# CVE
CVE-2025-60876: HTTP header injection in BusyBox 1.37.0 wget: the networking/wget.c URL parsing function accepts URLs containing ASCII control characters and space characters, allowing a server or redirect to craft a URL that injects arbitrary headers into subsequent HTTP requests.

# Vulnerable source (networking/wget.c)
```c
			fprintf(stderr, "--> %s%s\n\n", s1, s2);
		fflush(fp);
		log_io("> %s%s", s1, s2);
	}

	/* Read until "Nxx something" is received */
	G.wget_buf[3] = 0;
	do {
		fgets_trim_sanitize(fp, "%s\n");
	} while (!isdigit(G.wget_buf[0]) || G.wget_buf[3] != ' ');

	G.wget_buf[3] = '\0';
	result = xatoi_positive(G.wget_buf);
	G.wget_buf[3] = ' ';
	return result;
}
#endif

static void parse_url(const char *src_url, struct host_info *h)
{
	char *url, *p, *sp;

	free(h->allocated);
	h->allocated = url = xstrdup(src_url);

	h->protocol = P_HTTP;
	p = strstr(url, "://");
	if (p) {
		*p = '\0';
		h->host = p + 3;
#if ENABLE_FEATURE_WGET_FTP
		if (strcmp(url, P_FTP) == 0) {
			h->port = bb_lookup_std_port(P_FTP, "tcp", 21);
			h->protocol = P_FTP;
		} else
#endif
#if FTPS_SUPPORTED
		if (strcmp(url, P_FTPS) == 0) {
			h->port = bb_lookup_std_port(P_FTPS, "tcp", 990);
			h->protocol = P_FTPS;
```

[Assistant]
<<<<<<< SEARCH
{
	char *url, *p, *sp;

	free(h->allocated);
	h->allocated = url = xstrdup(src_url);
=======
{
	char *url, *p, *sp;

	/* Fix for CVE-2025-60876 - don't allow control characters or spaces in the URL */
	/* otherwise a malicious URL can be used to inject HTTP headers in the request */
	const unsigned char *u = (void *) src_url;
	while (*u) {
		if (*u <= ' ')
			bb_simple_error_msg_and_die("Unencoded control character found in the URL!");
		u++;
	}

	free(h->allocated);
	h->allocated = url = xstrdup(src_url);
>>>>>>> REPLACE


[System]
You are a security engineer fixing a CVE. You are given the vulnerability description (symptom only) and the vulnerable source window. Author the MINIMAL fix as one or more SEARCH/REPLACE blocks. Follow these rules exactly:
1. Each block is:
<<<<<<< SEARCH
<exact lines copied verbatim from the shown source window>
=======
<the replacement lines>
>>>>>>> REPLACE
2. The SEARCH text MUST appear verbatim in the shown source window — copy it exactly, including whitespace; do not invent or paraphrase it.
3. Change as few lines as possible; keep the SEARCH span tight around the edit.
4. Modify ONLY code visible in the shown source window.
5. Output only the SEARCH/REPLACE block(s) with no other text.
6. Prefer folding a new bound or check into an existing condition over adding a separate guard, when the upstream fix does so.

[User]
# CVE
CVE-2025-6170: Stack-buffer-overflow (CWE-787 out-of-bounds write) in libxml2's xmllint interactive shell. Affects the 2.13.x series; nixpkgs carries it as the libxml2_13 compat attr.

# Vulnerable source (debugXML.c, xmllint.c)
```c
/* ==== file: debugXML.c ==== */
    if ((node == NULL) || (buffer == NULL))
        return (-1);

    path = xmlGetNodePath(node);
    if (path == NULL)
	return (-1);

    /*
     * This test prevents buffer overflow, because this routine
     * is only called by xmlShell, in which the second argument is
     * 500 chars long.
     * It is a dirty hack before a cleaner solution is found.
     * Documentation should mention that the second argument must
     * be at least 500 chars long, and could be stripped if too long.
     */
    snprintf(buffer, 499, "%s", path);
    buffer[499] = '0';
    xmlFree(path);

    return (0);
}

/**
 * xmlShell:
 * @doc:  the initial document
 * @filename:  the output buffer
 * @input:  the line reading function
 * @output:  the output FILE*, defaults to stdout if NULL
 *
 * Implements the XML shell
 * This allow to load, validate, view, modify and save a document
 * using a environment similar to a UNIX commandline.
 */
void
xmlShell(xmlDocPtr doc, const char *filename, xmlShellReadlineFunc input,
         FILE * output)
{
    char prompt[500] = "/ > ";
    char *cmdline = NULL, *cur;
    char command[100];
    char arg[400];
    int i;
    xmlShellCtxtPtr ctxt;
    xmlXPathObjectPtr list;

    if (doc == NULL)
        return;
    if (filename == NULL)
        return;
    if (input == NULL)
        return;
    if (output == NULL)
        output = stdout;
    ctxt = (xmlShellCtxtPtr) xmlMalloc(sizeof(xmlShellCtxt));
    if (ctxt == NULL)
        /* ... */
                     (ctxt->node->ns->prefix), ctxt->node->name);
        else if ((ctxt->node != NULL) && (ctxt->node->name))
            snprintf(prompt, sizeof(prompt), "%s > ", ctxt->node->name);
        else
            snprintf(prompt, sizeof(prompt), "? > ");
        prompt[sizeof(prompt) - 1] = 0;

        /*
         * Get a new command line
         */
        cmdline = ctxt->input(prompt);
        if (cmdline == NULL)
            break;

        /*
         * Parse the command itself
         */
        cur = cmdline;
        while ((*cur == ' ') || (*cur == '\t'))
            cur++;
        i = 0;
        while ((*cur != ' ') && (*cur != '\t') &&
               (*cur != '\n') && (*cur != '\r')) {
            if (*cur == 0)
                break;
            command[i++] = *cur++;
        }
        command[i] = 0;
        if (i == 0)
            continue;

        /*
         * Parse the argument
         */
        while ((*cur == ' ') || (*cur == '\t'))
            cur++;
        i = 0;
        while ((*cur != '\n') && (*cur != '\r') && (*cur != 0)) {
            if (*cur == 0)
                break;
            arg[i++] = *cur++;
        }
        arg[i] = 0;

        /*
         * start interpreting the command
         */
        if (!strcmp(command, "exit"))
            break;
        if (!strcmp(command, "quit"))
            break;
        if (!strcmp(command, "bye"))
            break;
		if (!strcmp(command, "help")) {
		  fprintf(ctxt->output, "\tbase         display XML base of the node\n");

/* ==== file: xmllint.c ==== */

    xmlHTMLPrintFileInfo(input);

    fprintf(ERR_STREAM, "<b>validity warning</b>: ");
    va_start(args, msg);
    len = strlen(buffer);
    vsnprintf(&buffer[len],  sizeof(buffer) - len, msg, args);
    va_end(args);
    xmlHTMLEncodeSend();
    fprintf(ERR_STREAM, "</p>\n");

    xmlHTMLPrintFileContext(input);
    xmlHTMLEncodeSend();
}

/************************************************************************
 *									*
 *			Shell Interface					*
 *									*
 ************************************************************************/
#ifdef LIBXML_DEBUG_ENABLED
#ifdef LIBXML_XPATH_ENABLED
/**
 * xmlShellReadline:
 * @prompt:  the prompt value
 *
 * Read a string
 *
 * Returns a pointer to it or NULL on EOF the caller is expected to
 *     free the returned string.
 */
static char *
xmlShellReadline(char *prompt) {
#ifdef HAVE_LIBREADLINE
    char *line_read;

    /* Get a line from the user. */
    line_read = readline (prompt);

    /* If the line has any text in it, save it on the history. */
    if (line_read && *line_read)
	add_history (line_read);

    return (line_read);
#else
    char line_read[501];
    char *ret;
    int len;

    if (prompt != NULL)
	fprintf(stdout, "%s", prompt);
    fflush(stdout);
    if (!fgets(line_read, 500, stdin))
        return(NULL);
    line_read[500] = 0;
    len = strlen(line_read);
    ret = (char *) malloc(len + 1);
    if (ret != NULL) {
	memcpy (ret, line_read, len + 1);
    }
    return(ret);
#endif
}
#endif /* LIBXML_XPATH_ENABLED */
#endif /* LIBXML_DEBUG_ENABLED */

/************************************************************************
 *									*
 *			I/O Interfaces					*
 *									*
```

[Assistant]
<<<<<<< SEARCH
    return (0);
}

/**
 * xmlShell:
 * @doc:  the initial document
=======
    return (0);
}

#define MAX_PROMPT_SIZE     500
#define MAX_ARG_SIZE        400
#define MAX_COMMAND_SIZE    100

/**
 * xmlShell:
 * @doc:  the initial document
>>>>>>> REPLACE
<<<<<<< SEARCH
xmlShell(xmlDocPtr doc, const char *filename, xmlShellReadlineFunc input,
         FILE * output)
{
    char prompt[500] = "/ > ";
    char *cmdline = NULL, *cur;
    char command[100];
    char arg[400];
    int i;
    xmlShellCtxtPtr ctxt;
    xmlXPathObjectPtr list;
=======
xmlShell(xmlDocPtr doc, const char *filename, xmlShellReadlineFunc input,
         FILE * output)
{
    char prompt[MAX_PROMPT_SIZE] = "/ > ";
    char *cmdline = NULL, *cur;
    char command[MAX_COMMAND_SIZE];
    char arg[MAX_ARG_SIZE];
    int i;
    xmlShellCtxtPtr ctxt;
    xmlXPathObjectPtr list;
>>>>>>> REPLACE
<<<<<<< SEARCH
            cur++;
        i = 0;
        while ((*cur != ' ') && (*cur != '\t') &&
               (*cur != '\n') && (*cur != '\r')) {
            if (*cur == 0)
                break;
            command[i++] = *cur++;
=======
            cur++;
        i = 0;
        while ((*cur != ' ') && (*cur != '\t') &&
               (*cur != '\n') && (*cur != '\r') &&
               (i < (MAX_COMMAND_SIZE - 1))) {
            if (*cur == 0)
                break;
            command[i++] = *cur++;
>>>>>>> REPLACE
<<<<<<< SEARCH
        while ((*cur == ' ') || (*cur == '\t'))
            cur++;
        i = 0;
        while ((*cur != '\n') && (*cur != '\r') && (*cur != 0)) {
            if (*cur == 0)
                break;
            arg[i++] = *cur++;
=======
        while ((*cur == ' ') || (*cur == '\t'))
            cur++;
        i = 0;
        while ((*cur != '\n') && (*cur != '\r') && (*cur != 0) && (i < (MAX_ARG_SIZE-1))) {
            if (*cur == 0)
                break;
            arg[i++] = *cur++;
>>>>>>> REPLACE
<<<<<<< SEARCH
 ************************************************************************/
#ifdef LIBXML_DEBUG_ENABLED
#ifdef LIBXML_XPATH_ENABLED
/**
 * xmlShellReadline:
 * @prompt:  the prompt value
=======
 ************************************************************************/
#ifdef LIBXML_DEBUG_ENABLED
#ifdef LIBXML_XPATH_ENABLED

#define MAX_PROMPT_SIZE     500

/**
 * xmlShellReadline:
 * @prompt:  the prompt value
>>>>>>> REPLACE
<<<<<<< SEARCH
    if (prompt != NULL)
	fprintf(stdout, "%s", prompt);
    fflush(stdout);
    if (!fgets(line_read, 500, stdin))
        return(NULL);
    line_read[500] = 0;
    len = strlen(line_read);
    ret = (char *) malloc(len + 1);
    if (ret != NULL) {
=======
    if (prompt != NULL)
	fprintf(stdout, "%s", prompt);
    fflush(stdout);
    if (!fgets(line_read, MAX_PROMPT_SIZE, stdin))
        return(NULL);
    line_read[MAX_PROMPT_SIZE] = 0;
    len = strlen(line_read);
    ret = (char *) malloc(len + 1);
    if (ret != NULL) {
>>>>>>> REPLACE


[System]
You are a security engineer fixing a CVE. You are given the vulnerability description (symptom only) and the vulnerable source window. Author the MINIMAL fix as one or more SEARCH/REPLACE blocks. Follow these rules exactly:
1. Each block is:
<<<<<<< SEARCH
<exact lines copied verbatim from the shown source window>
=======
<the replacement lines>
>>>>>>> REPLACE
2. The SEARCH text MUST appear verbatim in the shown source window — copy it exactly, including whitespace; do not invent or paraphrase it.
3. Change as few lines as possible; keep the SEARCH span tight around the edit.
4. Modify ONLY code visible in the shown source window.
5. Output only the SEARCH/REPLACE block(s) with no other text.
6. Prefer folding a new bound or check into an existing condition over adding a separate guard, when the upstream fix does so.

[User]
# CVE
CVE-2025-64503: Out-of-bounds write (CWE-787) in libcupsfilters 2.1.1 cfFilterPDFToRaster() via the bundled PDF-to-raster filter. Reported as GHSA-893j-2wr2-wrh9.

# Vulnerable source (cupsfilters/pdftoraster.c)
```c
               "cfFilterPDFToRaster: cropbox = [ %f %f %f %f ]; rotate = %d",
               cropBox.x1, cropBox.x2, cropBox.y1, cropBox.y2,
               rotate);

  // Enter input page dimensions in header, so that if no page size got
  // specified for the job, the input size gets used via the header
  l = cropBox.x2 - cropBox.x1;
  if (l<0)
    l = -l;

  if (rotate == 90 || rotate == 270)
  doc->header.cupsPageSize[1] = l;
  else
  doc->header.cupsPageSize[0] = l;

  l = cropBox.y2 - cropBox.y1;
  if (l < 0)
    l = -l;
  if (rotate == 90 || rotate == 270)
    doc->header.cupsPageSize[0] = l;
  else
    doc->header.cupsPageSize[1] = l;
  if (rotate == 90 || rotate == 270)
  {
    doc->header.cupsImagingBBox[0] =
      doc->header.cupsPageSize[0] - cropBox.y1;
    doc->header.cupsImagingBBox[1] = cropBox.x2;
    doc->header.cupsImagingBBox[2] =
      doc->header.cupsPageSize[0] - cropBox.y2;
    doc->header.cupsImagingBBox[3] = cropBox.x1;
  }
 else
  {
    doc->header.cupsImagingBBox[0] = cropBox.x1;
    doc->header.cupsImagingBBox[1] =
      doc->header.cupsPageSize[1] - cropBox.y1;
    doc->header.cupsImagingBBox[2] = cropBox.x2;
    doc->header.cupsImagingBBox[3] =
      doc->header.cupsPageSize[1] - cropBox.y2;
  }
```

[Assistant]
<<<<<<< SEARCH
    doc->header.cupsPageSize[0] = l;
  else
    doc->header.cupsPageSize[1] = l;
  if (rotate == 90 || rotate == 270)
  {
    doc->header.cupsImagingBBox[0] =
=======
    doc->header.cupsPageSize[0] = l;
  else
    doc->header.cupsPageSize[1] = l;

  //
  // Maximum allowed page size for PDF is 200x200 inches (~ 5x5 m), or 14400x14400 pt
  // https://community.adobe.com/t5/indesign-discussions/maximum-width-of-a-pdf/td-p/9217372
  //
  if (doc->header.cupsPageSize[0] > 14400) {
    fprintf(stderr, "ERROR: Page width is %.2fpt, too large, cropping to 14400pt\n", doc->header.cupsPageSize[0]);
    doc->header.cupsPageSize[0] = 14400;
  }
  if (doc->header.cupsPageSize[1] > 14400) {
    fprintf(stderr, "ERROR: Page height is %.2fpt, too large, cropping to 14400pt\n", doc->header.cupsPageSize[1]);
    doc->header.cupsPageSize[1] = 14400;
  }

  if (rotate == 90 || rotate == 270)
  {
    doc->header.cupsImagingBBox[0] =
>>>>>>> REPLACE