Created attachment 325104 [details]
Put under doc/examples, "make io2" and "./io2" to see the seg fault

Hi,

I don't see any bug filed specifically for CVE-2016-2073:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2073

This one needs the name to be after DOCTYPE:
https://bugzilla.gnome.org/show_bug.cgi?id=749115
and this one is too vague:
https://bugzilla.gnome.org/show_bug.cgi?id=763686


Summary:
htmlParserNameComplex in HTMLparser.c is doing
    return(xmlDictLookup(ctxt->dict, ctxt->input->cur - len, len));
however, ctxt->input->cur is sometimes relocated and the pointer arithmetic is incorrect, pointing to the left of an allocated block.

Steps to reproduce:
The poc in the CVE requires to be run with Address Sanitizer in order to expose the issue, but I've managed to get a Segmentation Fault by allocating a huge chunk of the stack, so it can be reproduced without instrumentation. Just override io2.c in the doc/examples directory with the one attached and you'll probably see the segfault unless by chance it hits a valid memory location...

Best,
Sergio