CVE-2006-10003

XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer. The bug can be observed when parsing an XML file with very deep element nesting

XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer. The bug can be observed when parsing an XML file with very deep element nesting

Las versiones de XML::Parser hasta la 2.47 para Perl tienen un desbordamiento de búfer de montón por un error de uno en st_serial_stack. En el caso (stackptr == stacksize - 1), la pila NO se expandirá. Luego, el nuevo valor se escribirá en la ubicación (++stackptr), que es igual a stacksize y, por lo tanto, cae justo fuera del búfer asignado. El error se puede observar al analizar un archivo XML con anidamiento de elementos muy profundo.