- 07 Feb, 2017 7 commits
-
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
- 06 Feb, 2017 3 commits
-
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
- 05 Feb, 2017 5 commits
-
-
Nikias Bassen authored
-
Nikias Bassen authored
This commit adds proper debug/error messages being printed if the binary plist parser encounters anything abnormal. To enable debug logging, libplist must be configured with --enable-debug, and the environment variable PLIST_BIN_DEBUG must be set to "1".
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
- 04 Feb, 2017 1 commit
-
-
Nikias Bassen authored
Issue #92 pointed out an problem with (invalid) bplist files which have exactly one structured node whose subnode reference itself. The recursion check used a fixed size array with the size of the total number of objects. In this case the number of objects is 1 but the recursion check code wanted to set the node_index for the level 1 which leads to an OOB write on the heap. This commit fixes/improves two things: 1) Prevent OOB write by using a dynamic data storage for the used node indexes (plist_t of type PLIST_ARRAY) 2) Reduces the memory usage of large binary plists, because not the total number of nodes in the binary plist, but the number of recursion levels is important for the recursion check.
-
- 03 Feb, 2017 2 commits
-
-
Nikias Bassen authored
As reported in #91, the code that will read the big endian integer value of variable size did not check if the actual number of bytes is still withing the range of the actual plist data. This commit fixes the issue with proper bounds checking.
-
Nikias Bassen authored
-
- 01 Feb, 2017 3 commits
-
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
The sizes where effectively parsed by calling parse_uint_node() which allocates a node_t (along with plist_data_t) that is immediately freed after retrieving the integer value it holds. This commit changes the code to directly operate on the binary stream to 'just' read the size instead, reducing the memory footprint further.
-
- 28 Jan, 2017 9 commits
-
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
- 25 Jan, 2017 2 commits
-
-
Nikias Bassen authored
Apple only allows 32 bit unsigned values for UID nodes. Also the encoding of the length is different from the encoding used for other node types. The nibble used to mark the size is 1 less than the actual size of the integer value data, so 0 means 1 byte length 1 means 2 bytes length, etc.
-
Nikias Bassen authored
-
- 19 Jan, 2017 4 commits
-
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Wang Junjie authored
-
- 18 Jan, 2017 3 commits
-
-
Nikias Bassen authored
The uint24_from_be function used memcpy and a call to byte_convert. Instead the macro now shifts the data appropriately with a new beNtoh macro that eventually uses be64toh. This commit also fixes the problem where binary plist data with other non-power-of-2 sizes (like 5,6, or 7) where not handled correctly, and actually supports sizes larger than 8 bytes though only the last 8 bytes are actually converted (nobody will come up with such a large plist anyway).
-
Nikias Bassen authored
-
Nikias Bassen authored
As pointed out in #87 plistutil would do a memcmp with a heap buffer without checking the size. If the size is less than 8 it would read beyond the bounds of this heap buffer. This commit prevents that.
-
- 16 Jan, 2017 1 commit
-
-
Nikias Bassen authored
As reported in #86, the binary plist parser would force the type of the key node to be of type PLIST_KEY while the node might be of a different i.e. non-string type. A following plist_free() might then call free() on an invalid pointer; e.g. if the node is of type integer, its value would be considered a pointer, and free() would cause an error. We prevent this issue by disallowing non-string key nodes during parsing.
-