• Nikias Bassen's avatar
    bplist: Fix data range check for string/data/dict/array nodes · 32ee5213
    Nikias Bassen authored
    Passing a size of 0xFFFFFFFFFFFFFFFF to parse_string_node() might result
    in a memcpy with a size of -1, leading to undefined behavior.
    This commit makes sure that the actual node data (which depends on the size)
    is in the range start_of_object..start_of_object+size.
    
    Credit to OSS-Fuzz
    32ee5213
Name
Last commit
Last update
..
Array.cpp Loading commit data...
Boolean.cpp Loading commit data...
Data.cpp Loading commit data...
Date.cpp Loading commit data...
Dictionary.cpp Loading commit data...
Integer.cpp Loading commit data...
Key.cpp Loading commit data...
Makefile.am Loading commit data...
Node.cpp Loading commit data...
Real.cpp Loading commit data...
String.cpp Loading commit data...
Structure.cpp Loading commit data...
Uid.cpp Loading commit data...
base64.c Loading commit data...
base64.h Loading commit data...
bplist.c Loading commit data...
bytearray.c Loading commit data...
bytearray.h Loading commit data...
hashtable.c Loading commit data...
hashtable.h Loading commit data...
libplist++.pc.in Loading commit data...
libplist.pc.in Loading commit data...
plist.c Loading commit data...
plist.h Loading commit data...
ptrarray.c Loading commit data...
ptrarray.h Loading commit data...
strbuf.h Loading commit data...
time64.c Loading commit data...
time64.h Loading commit data...
time64_limits.h Loading commit data...
xplist.c Loading commit data...