Commit 135e43c1 authored by Jonathan Beck's avatar Jonathan Beck

Add sanity check on indexes when building plist tree.

parent 2a514976
...@@ -408,15 +408,19 @@ void plist_from_bin(const char *plist_bin, uint32_t length, plist_t * plist) ...@@ -408,15 +408,19 @@ void plist_from_bin(const char *plist_bin, uint32_t length, plist_t * plist)
//first one is actually a key //first one is actually a key
plist_get_data(nodeslist[index1])->type = PLIST_KEY; plist_get_data(nodeslist[index1])->type = PLIST_KEY;
if (G_NODE_IS_ROOT(nodeslist[index1])) if (index1 >= 0 && index1 < num_objects) {
g_node_append(nodeslist[i], nodeslist[index1]); if (G_NODE_IS_ROOT(nodeslist[index1]))
else g_node_append(nodeslist[i], nodeslist[index1]);
g_node_append(nodeslist[i], g_node_copy_deep(nodeslist[index1], copy_plist_data, NULL)); else
g_node_append(nodeslist[i], g_node_copy_deep(nodeslist[index1], copy_plist_data, NULL));
if (G_NODE_IS_ROOT(nodeslist[index2])) }
g_node_append(nodeslist[i], nodeslist[index2]);
else if (index2 >= 0 && index2 < num_objects) {
g_node_append(nodeslist[i], g_node_copy_deep(nodeslist[index2], copy_plist_data, NULL)); if (G_NODE_IS_ROOT(nodeslist[index2]))
g_node_append(nodeslist[i], nodeslist[index2]);
else
g_node_append(nodeslist[i], g_node_copy_deep(nodeslist[index2], copy_plist_data, NULL));
}
} }
free(data->buff); free(data->buff);
...@@ -428,11 +432,12 @@ void plist_from_bin(const char *plist_bin, uint32_t length, plist_t * plist) ...@@ -428,11 +432,12 @@ void plist_from_bin(const char *plist_bin, uint32_t length, plist_t * plist)
str_j = j * dict_param_size; str_j = j * dict_param_size;
index1 = swap_n_bytes(data->buff + str_j, dict_param_size); index1 = swap_n_bytes(data->buff + str_j, dict_param_size);
//g_node_append(nodeslist[i], nodeslist[index1]); if (index1 >= 0 && index1 < num_objects) {
if (G_NODE_IS_ROOT(nodeslist[index1])) if (G_NODE_IS_ROOT(nodeslist[index1]))
g_node_append(nodeslist[i], nodeslist[index1]); g_node_append(nodeslist[i], nodeslist[index1]);
else else
g_node_append(nodeslist[i], g_node_copy_deep(nodeslist[index1], copy_plist_data, NULL)); g_node_append(nodeslist[i], g_node_copy_deep(nodeslist[index1], copy_plist_data, NULL));
}
} }
free(data->buff); free(data->buff);
break; break;
......
...@@ -157,7 +157,7 @@ char compare_node_value(plist_type type, plist_data_t data, void *value, uint64_ ...@@ -157,7 +157,7 @@ char compare_node_value(plist_type type, plist_data_t data, void *value, uint64_
res = !wcscmp(data->unicodeval, ((wchar_t *) value)); res = !wcscmp(data->unicodeval, ((wchar_t *) value));
break; break;
case PLIST_DATA: case PLIST_DATA:
res = memcmp(data->buff,(char*) value, length ); res = memcmp(data->buff, (char *) value, length);
break; break;
case PLIST_ARRAY: case PLIST_ARRAY:
case PLIST_DICT: case PLIST_DICT:
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment