This doesn't matter, if libxml2 loads .so and the library is malicious, you are already potentially compromised, as it is possible to run code on library load.

> only to read and parse uncompressed XML…

how does libxml2 know to decompress something?

does it require you, as the caller, to explicitly tell it to?

or does it look at the magic bytes or filename or mimetype or something?

> how does libxml2 know to decompress something? > > does it require you, as the caller, to explicitly tell it to?

In the entry point/function that we use, `xmlReadMemory` (https://gnome.pages.gitlab.gnome.org/libxml2/devhelp/libxml2...), it doesn't handle compressed XML at all.

But there are indeed others where it attempts to auto-detect compression, although as I understand it from the docs only ZLib compression is autodetected… though I suspect these may be out-of-date and it may autodetect any/all compiled -in compression algorithms.

Regardless, the fact that it links with liblzma is cause for concern, given the mechanism of operation of the liblzma/xz backdoor.