Created attachment 322846 [details] Proposed patch from Drew Yao

Description of problem:

Drew Yao of Apple Product Security has reported an integer overflow present in xmlBufferResize function in the libxml2 library potentially leading to an infinite loop. User could provide a very large XML file for parsing to the XML parsing library, which could allow him to cause a denial of service.

Proposed patch: See attachment.

Acknowledgements:

Red Hat would like to thank Drew Yao of the Apple Product Security team for reporting this issue.

Created attachment 322841 [details] Proposed patch from Drew Yao

Description of problem:

Drew Yao from Apple Product Security has reported integer overflow leading to memory corruption present in the xmlSAX2Characters() function in the libxml2 library. User could trigger this flaw by providing very large XML file for parsing to the XML parsing library, which would corrupt the memory and might potentially allow arbitrary code execution.

Proposed patch: See attachment.

Acknowledgements:

Red Hat would like to thank Drew Yao of the Apple Product Security team for reporting this issue.