Heap Buffer Overflow

Psych is vulnerable to heap buffer overflow. The vulnerability is due to the startdocument function in psychemitter.c buffer head allocation based on the tags array length. This flaw allows an attacker to pass a specially constructed element of tags array object that can increase this array size...