Commit 72f7cf80 authored by Nikias Bassen's avatar Nikias Bassen

bplist: Fix integer overflow resulting in OOB heap buffer read

Credit to OSS-Fuzz
parent 8e4b7a59
......@@ -825,6 +825,11 @@ PLIST_API void plist_from_bin(const char *plist_bin, uint32_t length, plist_t *
return;
}
if (num_objects * offset_size < num_objects) {
PLIST_BIN_ERR("integer overflow when calculating offset table size (too many objects)\n");
return;
}
if (offset_table + num_objects * offset_size > end_data) {
PLIST_BIN_ERR("offset table points outside of valid range\n");
return;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment