Commit 8de732bd authored by Nikias Bassen's avatar Nikias Bassen

bplist: Fix offset table range check, don't rely on pointer overflow

parent 74425fec
......@@ -837,7 +837,7 @@ PLIST_API void plist_from_bin(const char *plist_bin, uint32_t length, plist_t *
return;
}
if ((offset_table + offset_table_size < offset_table) || (offset_table + offset_table_size > end_data)) {
if (offset_table_size > (uint64_t)(end_data - offset_table)) {
PLIST_BIN_ERR("offset table points outside of valid range\n");
return;
}
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment