- 18 Jan, 2017 1 commit
-
-
Nikias Bassen authored
As pointed out in #87 plistutil would do a memcmp with a heap buffer without checking the size. If the size is less than 8 it would read beyond the bounds of this heap buffer. This commit prevents that.
-
- 16 Jan, 2017 1 commit
-
-
Nikias Bassen authored
As reported in #86, the binary plist parser would force the type of the key node to be of type PLIST_KEY while the node might be of a different i.e. non-string type. A following plist_free() might then call free() on an invalid pointer; e.g. if the node is of type integer, its value would be considered a pointer, and free() would cause an error. We prevent this issue by disallowing non-string key nodes during parsing.
-
- 11 Jan, 2017 1 commit
-
-
Nikias Bassen authored
-
- 03 Jan, 2017 3 commits
-
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
While this works for libplist.dll, libplist++.dll will still have the _Unwind_Resume symbol being imported from libgcc_s_dw2-1.dll and there doesn't seem to be a way to prevent that.
-
- 02 Jan, 2017 3 commits
-
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
- 01 Jan, 2017 6 commits
-
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
'</key >' is a perfectly valid closing tag and so is '</key >' (note the newline). This commit will make the parser skip any encountered whitespace before checking for the closing '>'.
-
Nikias Bassen authored
-
- 27 Dec, 2016 2 commits
-
-
Nikias Bassen authored
-
Nikias Bassen authored
-
- 21 Dec, 2016 3 commits
-
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
- 14 Dec, 2016 4 commits
-
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
- 28 Nov, 2016 1 commit
-
-
Nikias Bassen authored
The context position counter was increased after encountering a closing node, e.g. '</dict>' or after a closing '</key>' node. When a node followed it directly without any whitespace inbetween, e.g. </dict><key>, parsing would fail since the parser would look at 'key>' instead of '<key>' for the next node to be parsed.
-
- 27 Nov, 2016 1 commit
-
-
Nikias Bassen authored
-
- 18 Nov, 2016 4 commits
-
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
- 13 Nov, 2016 5 commits
-
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Nikias Bassen authored
-
- 10 Nov, 2016 5 commits
-
-
Nikias Bassen authored
When NULL is passed to node_iterator_create() the code tries to access the begin element of the node list and causes a NULL pointer dereference. The value of list is checked a few lines down and iterator->value is then properly assigned in node_iterator_bind().
-
Nikias Bassen authored
Instead of e.g.: if (plist_get_node_type(plist) == PLIST_STRING) you can now write: if (PLIST_IS_STRING(plist))
-
Nikias Bassen authored
-
Nikias Bassen authored
-
Filippo Bigarella authored
If the allocation fails, a lot of bad things can happen so we check the result and return accordingly. We also check that the multiplication used to calculate the buffer size doesn't overflow. Otherwise this could lead to an allocation of a very small buffer compared to what we need, ultimately leading to arbitrary writes later on.
-