Commit b1be1e99 authored by Nikias Bassen's avatar Nikias Bassen

bplist: Make sure to detect integer overflow when handling unicode node size

Credit to OSS-Fuzz
parent 47d02dde
......@@ -668,6 +668,10 @@ static plist_t parse_bin_node(struct bplist_data *bplist, const char** object)
return parse_string_node(object, size);
case BPLIST_UNICODE:
if (size*2 < size) {
PLIST_BIN_ERR("%s: Integer overflow when calculating BPLIST_UNICODE data size.\n", __func__);
return NULL;
}
if (*object + size*2 > bplist->offset_table) {
PLIST_BIN_ERR("%s: BPLIST_UNICODE data bytes point outside of valid range\n", __func__);
return NULL;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment