Backport upstream fix (commit c9da977c) for CVE-2026-58016,
which corrects the XML parser state handling for `<node>` element
nesting in gdbusintrospection. The broken condition in
parser_start_element() failed to properly validate that `<node>`
elements can only appear at the top level or nested immediately
within another `<node>` element. The patch also adds unit tests
for invalid XML nesting scenarios.
CVE: CVE-2026-58016
Upstream patches:
- c9da977c17.patch
Resolves: RHEL-190627
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
