Commit 0be2a22a authored by Filippo Bigarella's avatar Filippo Bigarella Committed by Nikias Bassen

xplist: Prevent heap buffer overflow when parsing empty tags

If `ctx->pos - p - 1` is greater than `taglen`, we end up writing outside
the buffer pointed to by `tag`. This commit fixes it by checking the bounds
of the heap buffer before writing.
parent 6b9ab336
......@@ -662,7 +662,9 @@ static void node_from_xml(parse_ctx ctx, plist_t *plist)
return;
}
if (*(ctx->pos-1) == '/') {
tag[ctx->pos - p - 1] = '\0';
int idx = ctx->pos - p - 1;
if (idx < taglen)
tag[idx] = '\0';
is_empty = 1;
}
ctx->pos++;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment