Function ezxml_str2utf8() while parsing crafted XML file performs zero-length reallocation in ezxml.c:478 leading to returning NULL pointer in some compilers.
Zero-length (re)allocations are implementation-specific and should not be allowed - see following article for details:
https://wiki.sei.cmu.edu/confluence/display/c/MEM04-C.+Beware+of+zero-length+allocations
Function ezxml_parse_str() does not check whether s variable in not NULL in ezxml.c:481 leading to NULL pointer dereference and crash (segmentation fault).
ASAN report (segmentation fault occurs also without ASAN):
`=================================================================
==16981==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000000 (pc 0x000000412546 bp 0x0c24000017e3 sp 0x7ffc7ad665e0 T0)
0 0x412545 in ezxml_parse_str ezxml_0.8.6/ezxml.c:481
1 0x4168a2 in ezxml_parse_fd ezxml_0.8.6/ezxml.c:641
2 0x4168a2 in ezxml_parse_file ezxml_0.8.6/ezxml.c:659
3 0x4018e8 in main ezxml_0.8.6/test_ezxml.c:113
4 0x7f807507c82f in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2082f)
5 0x4019a8 in _start (ezxml_0.8.6/test_ezxml_asan.exe+0x4019a8)
==16981==ABORTING
`Reproduction:
Sample XML file leading to crash:
crash_000_SEGV_ezxml_parse_str.xml
Code snippet for reproduction:
ezxml_t result = ezxml_parse_file("crash_000_SEGV_ezxml_parse_str.xml");
Attached a proposed fix: Check if ezxml_str2utf8() has succeeded with performing a conversion and return with an error if not. This is different for the case that no conversion is required in that 's' remains untouched in that case.