Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Mon, 21 Mar 2016 10:57:51 -0300
From: Gustavo Grieco <gustavo.grieco@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: Stack exhaustion in libxml2 parsing xml files in recover mode

Hello,

We found a denegation of service parsing a specially crafted xml in libxml2
if recover mode is used. It was reported to the libxml2 bug tracker some
time ago but the maintainers are quite busy, so they haven't fixed it.

$ gdb --args xmllint --recover no-recover.xml
...
Program received signal SIGSEGV, Segmentation fault.
_int_malloc (av=0x7ffff7826760 <main_arena>, bytes=2) at malloc.c:3302
3302    malloc.c: No such file or directory.
(gdb) bt
#0  _int_malloc (av=0x7ffff7826760 <main_arena>, bytes=2) at malloc.c:3302
#1  0x00007ffff74ea7b0 in __GI___libc_malloc (bytes=2) at malloc.c:2891
#2  0x00007ffff78d9c19 in xmlStrndup__internal_alias (cur=0x555556888570
"b", len=1) at ../../xmlstring.c:45
#3  0x00007ffff7882800 in xmlNewReference__internal_alias
(doc=doc@...ry=0x55555577c000,
name=name@...ry=0x555556888570 "b") at ../../tree.c:2609
#4  0x00007ffff78856f7 in xmlStringGetNodeList__internal_alias
(doc=doc@...ry=0x55555577c000, value=<optimized out>) at ../../tree.c:1583
#5  0x00007ffff788592c in xmlStringGetNodeList__internal_alias
(doc=doc@...ry=0x55555577c000, value=<optimized out>) at ../../tree.c:1591
#6  0x00007ffff788592c in xmlStringGetNodeList__internal_alias
(doc=doc@...ry=0x55555577c000, value=<optimized out>) at ../../tree.c:1591
....

A reproducer is available upon request. Please assign a CVE.

Regards,
Gus.

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ