/ 
XML-Parser-2.24
Security Advisories (2)
CVE-2006-10002 (2026-03-19)

XML::Parser versions through 2.45 for Perl could overflow the pre-allocated buffer size cause a heap corruption (double free or corruption) and crashes. A :utf8 PerlIO layer, parse_stream() in Expat.xs could overflow the XML input buffer because Perl's read() returns decoded characters while SvPV() gives back multi-byte UTF-8 bytes that can exceed the pre-allocated buffer size. This can cause heap corruption (double free or corruption) and crashes.

CVE-2006-10003 (2026-03-19)

XML::Parser versions through 2.47 for Perl has an off-by-one heap buffer overflow in st_serial_stack. In the case (stackptr == stacksize - 1), the stack will NOT be expanded. Then the new value will be written at location (++stackptr), which equals stacksize and therefore falls just outside the allocated buffer. The bug can be observed when parsing an XML file with very deep element nesting

Changes for version 2.24 - 1999-07-08

  • KangChan Lee <dolphin@comeng.chungnam.ac.kr> supplied the EUC-KR encoding map.
  • Enno Derksen <enno@att.com> forwarded reports by Jon Eisenzopf <eisen@pobox.com> and Stefaan Onderbeke <onderbes@bec.bel.alcatel.be> about a core dump using XML::DOM. This was due to a bug in the prolog parsing part of XML::Parser.
  • Loic Dachary <loic@ceic.com> discovered that changing G_DISCARD to G_VOID introduced a small memory leak. Changed G_VOID back to G_DISCARD.
  • As suggested by Ben Holzman <bholzman@earthlink.net>, the setHandlers methods of both Parser and Expat now return lists that consist of type, handler pairs that correspond to the input, but the handlers returned are the ones that were in effect prior to the call.
  • Now using Version 19990626 of expat with a local patch (provided by James Clark.)
  • Added option ParseParamEnt. When set to a true value, parameter entities are parsed and the external DTD is read (unless standalone set to "Yes" in document).

Modules

XML::Parser::Expat
Lowlevel access to James Clark's expat XML parser
XML::Parser
A perl module for parsing XML documents

Provides

XML::Parser::Debug
in Parser.pm
XML::Parser::Encinfo
in Expat/Expat.pm
XML::Parser::ExpatNB
in Expat/Expat.pm
XML::Parser::Objects
in Parser.pm
XML::Parser::Stream
in Parser.pm
XML::Parser::Subs
in Parser.pm
XML::Parser::Tree
in Parser.pm

Examples

Other files