#16 Denial of Service vulnerability (infinite loop) while parsing malicious XML files

Egbert Eich — Mon, 25 Oct 2021 09:16:13 -0000

For me, this issue is resolved by the fix for bug 26.
Check my comment there.

Denial of Service vulnerability (infinite loop) while parsing malicious XML files

CVE Reporting — Sun, 29 Dec 2019 16:15:22 -0000

A maliciously crafted XML file triggers an infinite loop while parsing this file using one of ezxml_parse functions.
The loop is located inside the ezxml_decode function and incorrect handling of XML entities leads to inflate processed strings.
In the loop consecutive memory allocations are performed rapidly increasing memory usage until reaching memory limits or crashing the execution environment.

Recent changes to 16: Denial of Service vulnerability (infinite loop) while parsing malicious XML files

#16 Denial of Service vulnerability (infinite loop) while parsing malicious XML files

Denial of Service vulnerability (infinite loop) while parsing malicious XML files