HTACG Tidy-HTML5 Assertion Vulnerability in Parser Namespace Function

An assertion vulnerability has been identified in HTACG Tidy-HTML5 version 5.8.0. This issue arises in the 'prvTidyParseNamespace' function within 'src/parser.c', where a reachable assertion leads to a denial-of-service condition. The vulnerability requires local exploitation.

Impact

Exploitation of this vulnerability causes a denial-of-service condition by triggering an assertion failure, which leads to the application aborting.

Reproduction

The vulnerability can be reproduced by compiling Tidy-HTML5 with Clang, using address sanitization and Fuzzer integration. After compiling the application, the fuzzer can be run with a proof-of-concept input that triggers the assertion failure.