Buffer overflow in the SLPFoldWhiteSpace function in common/slpcompare.c in OpenSLP 2.0 allows remote attackers to have unspecified impact via a crafted string.

A null pointer dereference vulnerability was found in function xrealloc() in xlspxmalloc.c in OpenSLP. A remote attacker could potentially crash the server when large number of packets are sent.

Vulnerable code:

void xrealloc(const char file, int line, void ptr, sizet size) { xallocationt x;

if (!ptr) return xmalloc(file, line, size);

if (!size) { xfree(file, line, ptr); return 0; }

x = xmallocfind(ptr); if (x != 0) { void newptr = ptr; if (x->size != size) { newptr = xmalloc(file, line, size); // return 0 if failed from xmalloc memcpy(newptr, ptr, x->size); // it'll cased a null pointer reference xfree(file, line, x); } return newptr; }

if (Gxmallocfh) fprintf(Gxmallocfh, " xrealloc called on " "non-xmalloc'd memory \n");

return 0; }