CVE-2019-20198

Step 1: Payload Delivery: An attacker crafts a malicious XML file containing specially designed entity definitions.

Step 2: XML Parsing: The vulnerable application, using ezXML, attempts to parse the malicious XML file.

Step 3: Entity Resolution: The parser encounters the entity definitions and calls ezxml_ent_ok() to resolve them.

Step 4: Recursive Expansion: ezxml_ent_ok() enters a recursive loop, attempting to expand the malicious entities.

Step 5: Stack Exhaustion: The recursive calls consume increasing amounts of stack space.

Step 6: Crash: The stack overflows, leading to a program crash and denial of service.

The vulnerability lies within the ezxml_ent_ok() function of the ezXML library. This function is responsible for handling XML entity references. The flaw stems from improper handling of recursive entity definitions. Specifically, a crafted XML file can define entities that reference each other in a circular or deeply nested manner. When ezxml_ent_ok() attempts to resolve these recursive references, it enters a loop that consumes excessive stack space. This stack consumption eventually leads to a stack overflow, causing the program to crash. The root cause is a lack of proper recursion depth checks and a failure to prevent unbounded recursion during entity expansion. The vulnerability is a form of resource exhaustion, specifically targeting the stack.