Mirko Swillus

A signed integer overflow exists in the `storeAtts()` function within `lib/xmlparse.c`. An attacker can trigger out-of-bounds writes by providing a multi-gigabyte document containing a start tag with more than 2^30 attributes. This action overflows the `attIndex` and `nPrefixes` variables, which can lead to application crashes or heap memory corruption.

The MLS implementation (org.bouncycastle.mls) incorrectly handles the `leaf index` (a uint32 value from RFC 9420) by storing it as a signed integer. When a wire value has the top bit set, it decodes to a negative number. Because the functions `GroupKeySet.SecretTree.hasLeaf()` and `Group.validateRemove()` use signed comparisons against the tree's leaf count, negative integers are treated as being less than the positive bound, allowing out-of-range senders to bypass membership checks. In the case of `hasLeaf()`, the `SenderData` of an unprotected `PrivateMessage` can trigger `LeafIndex.directPath` to perform `NodeIndex.parent()` arithmetic that fails to reach the tree root. This causes the resulting node list to grow indefinitely until the Java Virtual Machine (JVM) exhausts its heap memory, leading to a denial of service for all group members via a single small message.