• Nikias Bassen's avatar
    bplist: Fix data range check for string/data/dict/array nodes · 32ee5213
    Nikias Bassen authored
    Passing a size of 0xFFFFFFFFFFFFFFFF to parse_string_node() might result
    in a memcpy with a size of -1, leading to undefined behavior.
    This commit makes sure that the actual node data (which depends on the size)
    is in the range start_of_object..start_of_object+size.
    
    Credit to OSS-Fuzz
    32ee5213
bplist.c 37.7 KB