The Patching Friars' AlmanacA calendar of CVE saints

Patron of June 12

Billion LaughsHoly card for billion-laughs, generated with AI (Claude, Anthropic) for the Lunario dei Frati Patchatori.CC BY-NC-SA 4.0 lol lol lol 1e9 Billion Laughs RISUS IN INFINITUM
🤖 Image and text generated with AI

⬇ Download holy card: ·

Embed on your site

Saint Billion Laughs, Who Buried Parsers in Laughter

Patron of XML parsers, entities that multiply, and people who laugh without getting the joke.

Life

In the early 2000s it turned out that a tiny XML document could bring a server to its knees. You define an entity lol worth "lol", then lol2 containing ten of them, lol3 containing ten lol2s, and so on up to lol9: a few bytes that, once expanded, become a billion laughs and gigabytes of memory. It hit libxml2 and many others, and ever since every serious parser carries a limit on expansions.

Prayer

O Saint Billion Laughs, who fills all of RAM with ten lines, set a limit on our entities and a brake on our laughter. Amen.

How to celebrate

Celebrated by disabling DTDs where they are not needed, capping entity expansion, and telling a joke just once.

He who laughs last laughs best, but the parser never gets to the end.

Technical record

Disclosed on
June 12 2002
CVE
CVE-2003-1564

libxml2, possibly before 2.5.0, does not properly detect recursion during entity expansion, which allows context-dependent attackers to cause a denial of service (memory and CPU consumption) via a crafted XML document containing a large number of nested entity references, aka the "billion laughs attack."

Sources: bugzilla.mozilla.org · en.wikipedia.org

📅 Add to your calendar

SaintsGoogle CalendarApple, Outlook (.ics)

Observances (feasts, scourges and miracles)Google CalendarApple, Outlook (.ics)

In Google Calendar you can also paste the URL in Settings → Add calendar → From URL. The first sync can take a few hours.