{"id":53362,"date":"2026-09-29T14:38:52","date_gmt":"2026-09-29T18:38:52","guid":{"rendered":"https:\/\/mjtsai.com\/blog\/?p=53362"},"modified":"2026-09-29T14:38:52","modified_gmt":"2026-09-29T18:38:52","slug":"cfxmlparser-7-byte-crasher","status":"publish","type":"post","link":"https:\/\/mjtsai.com\/blog\/2026\/09\/29\/cfxmlparser-7-byte-crasher\/","title":{"rendered":"CFXMLParser 7-Byte Crasher"},"content":{"rendered":"<p><a href=\"https:\/\/seriot.ch\/security\/cfxmlparser.html\">Nicolas Seriot<\/a>:<\/p>\n<blockquote cite=\"https:\/\/seriot.ch\/security\/cfxmlparser.html\">\n<pre>\/\/ \"&lt;a&gt;\" in UTF-16 LE + a single dangling byte\nconst UInt8 bytes[] = {'&lt;', 0, 'a', 0, '&gt;', 0, 'X'};<\/pre>\n<p>[&#8230;]<\/p>\n<p>The whole bug is a confusion between bytes left versus UTF-16 characters left. The result is repeated buffer doubling until allocation fails, and a local process crash if the exception is uncaught.<\/p>\n<\/blockquote>","protected":false},"excerpt":{"rendered":"<p>Nicolas Seriot: \/\/ \"&lt;a&gt;\" in UTF-16 LE + a single dangling byte const UInt8 bytes[] = {'&lt;', 0, 'a', 0, '&gt;', 0, 'X'}; [&#8230;] The whole bug is a confusion between bytes left versus UTF-16 characters left. The result is repeated buffer doubling until allocation fails, and a local process crash if the exception is [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"apple_news_api_created_at":"2026-09-29T18:38:56Z","apple_news_api_id":"ef6028fa-3ee6-43e9-83be-62e3b92a7e49","apple_news_api_modified_at":"2026-09-29T18:38:56Z","apple_news_api_revision":"AAAAAAAAAAD\/\/\/\/\/\/\/\/\/\/w==","apple_news_api_share_url":"https:\/\/apple.news\/A72Ao-j7mQ-mDvmLjuSp-SQ","apple_news_coverimage":0,"apple_news_coverimage_caption":"","apple_news_is_hidden":false,"apple_news_is_paid":false,"apple_news_is_preview":false,"apple_news_is_sponsored":false,"apple_news_maturity_rating":"","apple_news_metadata":"\"\"","apple_news_pullquote":"","apple_news_pullquote_position":"","apple_news_slug":"","apple_news_sections":"\"\"","apple_news_suppress_video_url":false,"apple_news_use_image_component":false,"footnotes":""},"categories":[4],"tags":[131,861,30,2784,71,258,866],"class_list":["post-53362","post","type-post","status-publish","format-standard","hentry","category-programming-category","tag-bug","tag-core-foundation","tag-mac","tag-macos-27","tag-programming","tag-unicode","tag-xml"],"apple_news_notices":[],"_links":{"self":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/53362","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/comments?post=53362"}],"version-history":[{"count":1,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/53362\/revisions"}],"predecessor-version":[{"id":53363,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/posts\/53362\/revisions\/53363"}],"wp:attachment":[{"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/media?parent=53362"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/categories?post=53362"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mjtsai.com\/blog\/wp-json\/wp\/v2\/tags?post=53362"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}