Commit 7a28a14c authored by Nikias Bassen's avatar Nikias Bassen

bplist: Disallow key nodes with non-string node types

As reported in #86, the binary plist parser would force the type of the
key node to be of type PLIST_KEY while the node might be of a different
i.e. non-string type. A following plist_free() might then call free() on
an invalid pointer; e.g. if the node is of type integer, its value would
be considered a pointer, and free() would cause an error.
We prevent this issue by disallowing non-string key nodes during parsing.
parent 3a55ddd3
......@@ -441,6 +441,13 @@ static plist_t parse_dict_node(struct bplist_data *bplist, const char** bnode, u
plist_free(node);
return NULL;
}
if (plist_get_data(key)->type != PLIST_STRING) {
fprintf(stderr, "ERROR: Malformed binary plist dict, invalid node type for key!\n");
plist_free(node);
return NULL;
}
/* enforce key type */
plist_get_data(key)->type = PLIST_KEY;
if (!plist_get_data(key)->strval) {
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment