An issue was discovered in ezXML 0.8.3 through 0.8.6. The function ezxml_decode, while parsing a crafted XML file, performs incorrect memory handling, leading to NULL pointer dereference while running strlen() on a NULL pointer.
ezXML, a library for parsing XML files, is vulnerable to a NULL pointer dereference due to incorrect memory handling. This allows attackers to craft malicious XML files that can cause a denial-of-service (DoS) by crashing applications that use the library. Successful exploitation can disrupt critical services and impact system availability.
Step 1: Payload Delivery: The attacker crafts a malicious XML file containing specifically designed malformed or unexpected data. This XML file is designed to trigger the vulnerability within the ezxml_decode function.
Step 2: File Ingestion: The targeted application, which uses the vulnerable ezXML library, attempts to parse the malicious XML file. This could be triggered through various means, such as a web server receiving a POST request containing the XML, or a file processing application opening the malicious file.
Step 3: Vulnerability Trigger: During the parsing process, the ezxml_decode function encounters the malformed data. Due to insufficient input validation, the function incorrectly handles memory allocation, leading to a NULL pointer being assigned.
Step 4: NULL Pointer Dereference: The code attempts to use the NULL pointer, typically within a call to strlen(). This action results in a crash, causing a denial-of-service (DoS) condition for the application.
The vulnerability lies within the ezxml_decode function of the ezXML library. When parsing a specially crafted XML file, the function fails to properly handle memory allocation and deallocation. Specifically, the vulnerability occurs when the library attempts to process an XML structure containing malformed or unexpected data. This leads to a scenario where a pointer, intended to point to a valid memory location, is instead assigned a NULL value. Subsequently, the code attempts to use this NULL pointer, specifically within a call to strlen(), which results in a NULL pointer dereference. This causes the application using ezXML to crash, resulting in a DoS condition. The root cause is a lack of proper input validation and error handling within the XML parsing logic, allowing the crafted XML to trigger the memory corruption.