In the logic behind the function xml_recreate_namespace, five heap buffer overflow bugs exist (lines 268, 281, 288, 295 and 229).
Everywhere where (*(c + 5) == ':') is executed, there is no guarantee that the buffer is at least 6 bytes. If the value returned by mxmlElementGetAttrName() is 5 bytes or less (4 chars plus the null termination byte), the program will try to read out of bounds, resulting in a heap buffer overflow.
This findings are the results of a fuzzing initiative, all the fuzzing results are available in this repository
In the logic behind the function xml_recreate_namespace, five heap buffer overflow bugs exist (lines 268, 281, 288, 295 and 229).
Everywhere where
(*(c + 5) == ':')is executed, there is no guarantee that the buffer is at least 6 bytes. If the value returned bymxmlElementGetAttrName()is 5 bytes or less (4 chars plus the null termination byte), the program will try to read out of bounds, resulting in a heap buffer overflow.This findings are the results of a fuzzing initiative, all the fuzzing results are available in this repository