Sparklemotion Nokogiri Heap-Based Buffer Overflow Vulnerability in Hashmap Function

A heap-based buffer overflow vulnerability has been identified in Sparklemotion Nokogiri versions through 1.18.7. The issue arises in the function 'hashmap_get_with_hash' within 'gumbo-parser/src/hashmap.c'. This vulnerability can be exploited locally, leading to a denial-of-service condition.

Impact

Exploitation of this vulnerability causes a heap-based buffer overflow, which can lead to memory corruption and potentially allow for arbitrary code execution.

Reproduction

The vulnerability can be reproduced using a fuzzing harness that is part of the Nokogiri project. After compiling Nokogiri with Clang and AddressSanitizer enabled, the fuzzer can be run with a specially crafted input that triggers the buffer overflow.