CVE-2023-34795: Use After Free (CWE-416)
value: xlsxio v0.1.2 to v0.2.34 was discovered to contain a free of uninitialized pointer in the xlsxioread_sheetlist_close() function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted XLSX file.
CWE description: The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CVSS v3 base score: 7.8
Published: 2023-06-16T16:15Z
Repository: https://github.com/brechtsanders/xlsxio
Language: C
Files changed: Changelog.txt, include/xlsxio_version.h, lib/xlsxio_read.c
Commit date: 2023-05-30 17:48:32 +0200
Diff: diff --git a/Changelog.txt b/Changelog.txt
index 785220b..e477cf5 100644
--- a/Changelog.txt
+++ b/Changelog.txt
@@ -1,10 +1,16 @@
+0.2.35
+
+2023-05-30  Brecht Sanders  https://github.com/brechtsanders/
+
+  * fix free of uninitialized pointer in xlsxioread_sheetlist_close() (#121)
+
 0.2.34
 
 2022-11-02  Brecht Sanders  https://github.com/brechtsanders/
 
-  * PR from captaingroove tp add minizip-ng support (#115)
+  * PR from captaingroove to add minizip-ng support (#115)
 
 0.2.33
 
 2022-07-05  Brecht Sanders  https://github.com/brechtsanders/
 
diff --git a/include/xlsxio_version.h b/include/xlsxio_version.h
index 9322b09..eb07707 100644
--- a/include/xlsxio_version.h
+++ b/include/xlsxio_version.h
@@ -47,11 +47,11 @@ THE SOFTWARE.
 /*! \brief major version number */
 #define XLSXIO_VERSION_MAJOR 0
 /*! \brief minor version number */
 #define XLSXIO_VERSION_MINOR 2
 /*! \brief micro version number */
-#define XLSXIO_VERSION_MICRO 34
+#define XLSXIO_VERSION_MICRO 35
 /*! @} */
 
 /*! \cond PRIVATE */
 #ifndef XML_UNICODE_WCHAR_T
 #define XLSXIO_VERSION_STRINGIZE_(major, minor, micro) #major"."#minor"."#micro
diff --git a/lib/xlsxio_read.c b/lib/xlsxio_read.c
index 8c90d66..b751fb3 100644
--- a/lib/xlsxio_read.c
+++ b/lib/xlsxio_read.c
@@ -1408,10 +1408,11 @@ DLL_EXPORT_XLSXIO xlsxioreadersheetlist xlsxioread_sheetlist_open (xlsxioreader
     return NULL;
   result->handle = handle;
   result->sheetcallbackdata.xmlparser = NULL;
   result->sheetcallbackdata.callback = xlsxioread_list_sheets_resumable_callback;
   result->sheetcallbackdata.callbackdata = result;
+  result->xmlparser = NULL;
   result->nextsheetname = NULL;
   if ((result->zipfile = XML_Char_openzip(handle->zip, mainsheetfile, 0)) != NULL) {
     result->xmlparser = expat_process_zip_file_suspendable(result->zipfile, main_sheet_list_expat_callback_element_start, NULL, NULL, &result->sheetcallbackdata);
   }
   //clean up

Vulnerable code:   * PR from captaingroove tp add minizip-ng support (#115)
#define XLSXIO_VERSION_MICRO 34
Fixed code: 0.2.35

2023-05-30  Brecht Sanders  https://github.com/brechtsanders/

  * fix free of uninitialized pointer in xlsxioread_sheetlist_close() (#121)

  * PR from captaingroove to add minizip-ng support (#115)
#define XLSXIO_VERSION_MICRO 35
  result->xmlparser = NULL;