Tlsbollei

The software allows attacker-controlled processing instruction (PI) data to be serialized into XML without validating or neutralizing the PI-closing sequence `?>`. This occurs because the `createProcessingInstruction()` function stores the `data` variable directly without validation, and the serializer subsequently concatenates this data verbatim. An attacker can use the `?>` sequence to terminate the processing instruction prematurely and inject arbitrary XML nodes into the serialized output, potentially altering the structure and meaning of the generated XML documents.

The ` strindices` builtin in `src/builtin.c` passes arguments to `jv string indexes()` in `src/jv.c` without verifying they are strings. Because `jv string indexes()` relies on `assert()` checks that are removed in release builds compiled with `-DNDEBUG`, an attacker can cause a crash by providing input such as ` strindices(0)`. Additionally, by crafting a numeric value with an IEEE-754 bit pattern that maps to a specific pointer, a controlled pointer dereference and limited memory read/probe primitive can be achieved. This affects deployments that evaluate untrusted filters against a release build.