libexpat Buffer Size Mismanagement in doContent Function Leading to Integer Overflow Vulnerability

A vulnerability exists in libexpat versions prior to 2.7.4, where the doContent function improperly calculates the buffer size due to a lack of integer overflow checks during tag buffer reallocation. This oversight can lead to memory allocation errors or potential exploitation.

Impact

The vulnerability allows for integer overflow, which can be exploited to cause memory allocation errors or potentially manipulate memory in a way that could be exploited.

Remediation

Users can upgrade to libexpat version 2.7.4 or later to address this vulnerability.