Backport upstream commit c2e233fc1b34 to fix CVE-2026-11979,
which adds overflow bounds checks in the usershell() function
of xmlcatalog.c. The patch prevents buffer overflows when
processing large --shell commands by adding capacity checks
for the command buffer, argument buffer, and argv array size.
The upstream test changes were dropped as the test
infrastructure (test/catalogs/test.sh) does not exist in the
v2.9.7 source tree.
CVE: CVE-2026-11979
Upstream patches:
- c2e233fc1b.patch
Resolves: RHEL-215569
This commit was backported by Ymir, a Red Hat Enterprise Linux software maintenance AI agent.
Assisted-by: Ymir
