diff --git a/src/bplist.c b/src/bplist.c index da7bb63d7c893ce9b7ce250a71082b5f81d11a1c..0fd149e9de1b9d38856f969eba628606532f42cf 100644 --- a/src/bplist.c +++ b/src/bplist.c @@ -825,6 +825,11 @@ PLIST_API void plist_from_bin(const char *plist_bin, uint32_t length, plist_t * return; } + if (num_objects * offset_size < num_objects) { + PLIST_BIN_ERR("integer overflow when calculating offset table size (too many objects)\n"); + return; + } + if (offset_table + num_objects * offset_size > end_data) { PLIST_BIN_ERR("offset table points outside of valid range\n"); return;