Scott Cantor created XERCESC-2270:
-------------------------------------
Summary: Nested elements can exhaust stack
Key: XERCESC-2270
URL: https://issues.apache.org/jira/browse/XERCESC-2270
Project: Xerces-C++
Issue Type: Bug
Components: DOM, Non-Validating Parser, SAX/SAX2
Affects Versions: 3.3.0
Reporter: Scott Cantor
Assignee: Scott Cantor
Fix For: 3.3.1
Heavily nested content isn't handled properly and the stack for tracking
element state isn't expanded sufficiently.
A simple fix can correct for this, but does not prevent an out of memory
condition, so the parser remains vulnerable to such attacks as it doesn't
implement the kinds of constraints needed for that protection, so that would be
a much larger fix.
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
