diff options
| author |  Nikias Bassen | 2017-02-09 14:50:48 +0100 |
|---|---|---|
| committer | Nikias Bassen | 2017-02-09 14:50:48 +0100 |
| commit | b1be1e99dd1f489720e83d018bcbdb91fb1e87e5 (patch) | |
| tree | fcf66358aeb7826b273ca8c52576b6e910c4fa63 /src/bplist.c | |
| parent | 47d02dde60b4c709d579aa22187ac55524485b97 (diff) | |
| download | libplist-b1be1e99dd1f489720e83d018bcbdb91fb1e87e5.tar.gz libplist-b1be1e99dd1f489720e83d018bcbdb91fb1e87e5.tar.bz2 | |
bplist: Make sure to detect integer overflow when handling unicode node size
Credit to OSS-Fuzz
Diffstat (limited to 'src/bplist.c')
| -rw-r--r-- | src/bplist.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/bplist.c b/src/bplist.c index bf8d985..da7bb63 100644 --- a/src/bplist.c +++ b/src/bplist.c @@ -668,6 +668,10 @@ static plist_t parse_bin_node(struct bplist_data *bplist, const char** object) return parse_string_node(object, size); case BPLIST_UNICODE: + if (size*2 < size) { + PLIST_BIN_ERR("%s: Integer overflow when calculating BPLIST_UNICODE data size.\n", __func__); + return NULL; + } if (*object + size*2 > bplist->offset_table) { PLIST_BIN_ERR("%s: BPLIST_UNICODE data bytes point outside of valid range\n", __func__); return NULL; |