Commit b86a392b authored by Filippo Bigarella's avatar Filippo Bigarella Committed by Nikias Bassen

bplist: Fix possible out-of-bounds reads in parse_bin_node() with proper bounds checking

parent a4563ffe
...@@ -568,15 +568,21 @@ static plist_t parse_bin_node(struct bplist_data *bplist, const char** object) ...@@ -568,15 +568,21 @@ static plist_t parse_bin_node(struct bplist_data *bplist, const char** object)
} }
case BPLIST_UINT: case BPLIST_UINT:
if (*object - bplist->data + (uint64_t)(1 << size) >= bplist->size)
return NULL;
return parse_uint_node(object, size); return parse_uint_node(object, size);
case BPLIST_REAL: case BPLIST_REAL:
if (*object - bplist->data + (uint64_t)(1 << size) >= bplist->size)
return NULL;
return parse_real_node(object, size); return parse_real_node(object, size);
case BPLIST_DATE: case BPLIST_DATE:
if (3 != size) if (3 != size)
return NULL; return NULL;
else else
if (*object - bplist->data + (uint64_t)(1 << size) >= bplist->size)
return NULL;
return parse_date_node(object, size); return parse_date_node(object, size);
case BPLIST_DATA: case BPLIST_DATA:
...@@ -587,6 +593,9 @@ static plist_t parse_bin_node(struct bplist_data *bplist, const char** object) ...@@ -587,6 +593,9 @@ static plist_t parse_bin_node(struct bplist_data *bplist, const char** object)
plist_get_uint_val(size_node, &size); plist_get_uint_val(size_node, &size);
plist_free(size_node); plist_free(size_node);
} }
if (*object - bplist->data + size >= bplist->size)
return NULL;
return parse_data_node(object, size); return parse_data_node(object, size);
case BPLIST_STRING: case BPLIST_STRING:
...@@ -597,6 +606,9 @@ static plist_t parse_bin_node(struct bplist_data *bplist, const char** object) ...@@ -597,6 +606,9 @@ static plist_t parse_bin_node(struct bplist_data *bplist, const char** object)
plist_get_uint_val(size_node, &size); plist_get_uint_val(size_node, &size);
plist_free(size_node); plist_free(size_node);
} }
if (*object - bplist->data + size >= bplist->size)
return NULL;
return parse_string_node(object, size); return parse_string_node(object, size);
case BPLIST_UNICODE: case BPLIST_UNICODE:
...@@ -607,6 +619,9 @@ static plist_t parse_bin_node(struct bplist_data *bplist, const char** object) ...@@ -607,6 +619,9 @@ static plist_t parse_bin_node(struct bplist_data *bplist, const char** object)
plist_get_uint_val(size_node, &size); plist_get_uint_val(size_node, &size);
plist_free(size_node); plist_free(size_node);
} }
if (*object - bplist->data + size * 2 >= bplist->size)
return NULL;
return parse_unicode_node(object, size); return parse_unicode_node(object, size);
case BPLIST_SET: case BPLIST_SET:
...@@ -618,6 +633,9 @@ static plist_t parse_bin_node(struct bplist_data *bplist, const char** object) ...@@ -618,6 +633,9 @@ static plist_t parse_bin_node(struct bplist_data *bplist, const char** object)
plist_get_uint_val(size_node, &size); plist_get_uint_val(size_node, &size);
plist_free(size_node); plist_free(size_node);
} }
if (*object - bplist->data + size >= bplist->size)
return NULL;
return parse_array_node(bplist, object, size); return parse_array_node(bplist, object, size);
case BPLIST_UID: case BPLIST_UID:
...@@ -631,6 +649,9 @@ static plist_t parse_bin_node(struct bplist_data *bplist, const char** object) ...@@ -631,6 +649,9 @@ static plist_t parse_bin_node(struct bplist_data *bplist, const char** object)
plist_get_uint_val(size_node, &size); plist_get_uint_val(size_node, &size);
plist_free(size_node); plist_free(size_node);
} }
if (*object - bplist->data + size >= bplist->size)
return NULL;
return parse_dict_node(bplist, object, size); return parse_dict_node(bplist, object, size);
default: default:
return NULL; return NULL;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment