Commit 17b8e01b authored by Filippo Bigarella's avatar Filippo Bigarella Committed by Nikias Bassen

xplist: Prevent UaF when parsing structured nodes fails

In case parsing inside `node_from_xml` called from line 842 fails, `data`
gets freed by the call to `plist_free` at line 899, since `subnode` is
actually created by making it point to `data` at line 684. This commit
prevents this situation by bailing out whenever parsing in a deeper level
of structured nodes fails.
parent 0be2a22a
......@@ -840,6 +840,11 @@ static void node_from_xml(parse_ctx ctx, plist_t *plist)
if (!is_empty) {
/* only if not empty */
node_from_xml(ctx, &subnode);
if (ctx->err) {
/* make sure to bail out if parsing failed */
free(keyname);
return;
}
if ((data->type == PLIST_DICT) && (plist_dict_get_size(subnode) == 1)) {
/* convert XML CF$UID dictionaries to PLIST_UID nodes */
plist_t uid = plist_dict_get_item(subnode, "CF$UID");
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment