[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CACn5sdSPZ7+z-LGK1PBrmv6ozCVHhNA6XCrQpJc-YR09ickhAA@mail.gmail.com>
Date: Mon, 21 Mar 2016 10:57:51 -0300
From: Gustavo Grieco <gustavo.grieco@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: Stack exhaustion in libxml2 parsing xml files in recover mode
Hello,
We found a denegation of service parsing a specially crafted xml in libxml2
if recover mode is used. It was reported to the libxml2 bug tracker some
time ago but the maintainers are quite busy, so they haven't fixed it.
$ gdb --args xmllint --recover no-recover.xml
...
Program received signal SIGSEGV, Segmentation fault.
_int_malloc (av=0x7ffff7826760 <main_arena>, bytes=2) at malloc.c:3302
3302 malloc.c: No such file or directory.
(gdb) bt
#0 _int_malloc (av=0x7ffff7826760 <main_arena>, bytes=2) at malloc.c:3302
#1 0x00007ffff74ea7b0 in __GI___libc_malloc (bytes=2) at malloc.c:2891
#2 0x00007ffff78d9c19 in xmlStrndup__internal_alias (cur=0x555556888570
"b", len=1) at ../../xmlstring.c:45
#3 0x00007ffff7882800 in xmlNewReference__internal_alias
(doc=doc@...ry=0x55555577c000,
name=name@...ry=0x555556888570 "b") at ../../tree.c:2609
#4 0x00007ffff78856f7 in xmlStringGetNodeList__internal_alias
(doc=doc@...ry=0x55555577c000, value=<optimized out>) at ../../tree.c:1583
#5 0x00007ffff788592c in xmlStringGetNodeList__internal_alias
(doc=doc@...ry=0x55555577c000, value=<optimized out>) at ../../tree.c:1591
#6 0x00007ffff788592c in xmlStringGetNodeList__internal_alias
(doc=doc@...ry=0x55555577c000, value=<optimized out>) at ../../tree.c:1591
....
A reproducer is available upon request. Please assign a CVE.
Regards,
Gus.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
