AIKIDO-2026-10542

TL;DR

The native parser in ext/ox/parse.c includes collapse_special, which decodes &name; entity text into a small on-stack key buffer. When a named token grew past the buffer, the k cursor hit the end sentinel and the code set k back to the buffer start in a way that no longer matched the k-- and null-termination that run immediately after the loop, leaving k inconsistent and allowing invalid pointer use and buffer corruption. Malicious or very long entity-like sequences in attributes or text that reach this path can stress that logic. The change points k at key+1 in the overflow case before breaking so the following decrement and entity lookup see a valid buffer state.