Commit 23fe533a authored by Filippo Bigarella's avatar Filippo Bigarella Committed by Nikias Bassen

bplist: Make sure to error out if allocation of `used_indexes` buffer in plist_from_bin() fails

If the allocation fails, a lot of bad things can happen so we check the
result and return accordingly. We also check that the multiplication used
to calculate the buffer size doesn't overflow. Otherwise this could lead
to an allocation of a very small buffer compared to what we need, ultimately
leading to arbitrary writes later on.
parent a4ca24c4
......@@ -742,6 +742,9 @@ PLIST_API void plist_from_bin(const char *plist_bin, uint32_t length, plist_t *
if (offset_table + num_objects * offset_size >= plist_bin + length)
return;
if (sizeof(uint32_t) * num_objects < num_objects)
return;
struct bplist_data bplist;
bplist.data = plist_bin;
bplist.size = length;
......@@ -752,6 +755,9 @@ PLIST_API void plist_from_bin(const char *plist_bin, uint32_t length, plist_t *
bplist.level = 0;
bplist.used_indexes = (uint32_t*)malloc(sizeof(uint32_t) * num_objects);
if (!bplist.used_indexes)
return;
*plist = parse_bin_node_at_index(&bplist, root_object);
free(bplist.used_indexes);
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment