New release request

[shrikantpalekar]

I see some very important issues are fixed specifically Integer Overflow Vulnerability - XMLUtil::GetCharacterRef(). Please create new releas

[shrikantpalekar]

@leethomason if you could help

[shrikantpalekar]

Hi @leethomason , if you could merge security related issues in one release would be great help for me... I think all closed jira which are comitted for security related issues , please give us one release...

[SomeNotNotTakenUsername]

I see some very important issues are fixed specifically Integer Overflow Vulnerability - XMLUtil::GetCharacterRef(). Please create new releas

If you actually look at the vulnerability you can notice it isn't important, there's an overflow yes, but later there's a check on the value and you can't achieve any OOB Reads/Writes from this, the only thing it does is let you skip writing the entity...

This won't make or break what you're trying to do. And if it still hurts you, compile the project with the fix if it's that important.

[shrikantpalekar]

Hi @SomeNotNotTakenUsername ,
Actually I am using mfast which internally using tinyxml. In the security scan of my project , which internally consider tinyxml as a third party library , it is showing vulnerability of overflow issue. I tried compiling security branch and putting it , but until we have an official release, the scan will continue to show this issue. It requires official release .