| 제목 | mxml v4.0.5, v4.0.6 Use After Free |
|---|
| 설명 | Mini-XML (mxml) v4.0.5 and v4.0.6 contain a use-after-free vulnerability, in the common error path of mxml_load_data() in mxml-file.c. The cleanup code calls mxmlDelete(node) and then mxmlDelete(first) without checking whether first is a descendant of node. Because mxmlDelete() is recursive, mxmlDelete(node) can already free first when node is an ancestor of first; the subsequent mxmlDelete(first) then dereferences freed memory. AddressSanitizer reports the read in mxmlRemove() at mxml-node.c:757. The same error path can also free the caller-supplied top node. As a result, after a failed mxmlLoadString(), the caller’s top pointer is left dangling, and a later mxmlDelete(top) by the caller causes another use-after-free. This issue was introduced by the fix for issue #354. Processing malformed XML can trigger a reliable crash and potentially heap corruption. |
|---|
| 원천 | ⚠️ https://github.com/michaelrsweet/mxml/issues/358 |
|---|
| 사용자 | suyuanwang (UID 101634) |
|---|
| 제출 | 2026. 10. 02. PM 05:21 (1 월 ago) |
|---|
| 모더레이션 | 2026. 10. 18. PM 07:05 (16 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 421908 [michaelrsweet mxml 4.0.5/4.0.6 mxml-file.c mxml_load_data 메모리 손상] |
|---|
| 포인트들 | 20 |
|---|