Commit fc047e6d authored by Nikias Bassen's avatar Nikias Bassen

bplist: Prevent OOB read when parsing data/string/array/dict size nodes

As reported in #91, the code that will read the big endian integer value
of variable size did not check if the actual number of bytes is still
withing the range of the actual plist data.
This commit fixes the issue with proper bounds checking.
parent 3ca4f0ae
......@@ -530,6 +530,8 @@ static plist_t parse_bin_node(struct bplist_data *bplist, const char** object)
return NULL;
(*object)++;
next_size = 1 << next_size;
if (*object + next_size >= bplist->data + bplist->size)
return NULL;
size = UINT_TO_HOST(*object, next_size);
(*object) += next_size;
break;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment