Description (CNA)
In libexpat before 2.7.4, the doContent function does not properly determine the buffer size bufSize because there is no integer overflow check for tag buffer reallocation.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| libexpat project / libexpat | affected 0 before 2.7.4 |
CWE
CWE-190
References
- https://github.com/libexpat/libexpat/pull/1075
- https://github.com/libexpat/libexpat/pull/1075/commits/9c2d990389e6abe2e44527eeaa8b39f16fe859c7
ADP enrichment
No English description supplied.
No references supplied.
No English description supplied.