diff options
| author |  Nikias Bassen | 2015-01-31 20:19:40 +0100 |
|---|---|---|
| committer | Nikias Bassen | 2015-01-31 20:19:40 +0100 |
| commit | 9da6e82da3552daf27bf50cc3308bdac886dc28d (patch) | |
| tree | d5b1b6875e4e9ded9e1f5b7edca7a7578cce0bc3 | |
| parent | 3c4bf492e5211e4196de872b823370670d8c56fc (diff) | |
| download | libplist-9da6e82da3552daf27bf50cc3308bdac886dc28d.tar.gz libplist-9da6e82da3552daf27bf50cc3308bdac886dc28d.tar.bz2 | |
bplist: Fix possible crash in plist_from_bin() caused by access to already freed memory
Given a specifically ordered binary plist the function plist_from_bin() would
free BPLIST_DICT or BPLIST_ARRAY raw node data that is still required for
parsing of following nodes. This commit addresses this issues by moving the
memory free to the end of the parsing process.
| -rw-r--r-- | src/bplist.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/src/bplist.c b/src/bplist.c index 40b453b..cbe9481 100644 --- a/src/bplist.c +++ b/src/bplist.c @@ -720,8 +720,6 @@ PLIST_API void plist_from_bin(const char *plist_bin, uint32_t length, plist_t * node_attach(nodeslist[i], n); } } - - free(data->buff); break; case PLIST_ARRAY: @@ -738,7 +736,6 @@ PLIST_API void plist_from_bin(const char *plist_bin, uint32_t length, plist_t * node_attach(nodeslist[i], node_copy_deep(nodeslist[index1], copy_plist_data)); } } - free(data->buff); break; default: break; @@ -749,6 +746,11 @@ PLIST_API void plist_from_bin(const char *plist_bin, uint32_t length, plist_t * // free unreferenced nodes that would otherwise leak memory for (i = 0; i < num_objects; i++) { + plist_data_t data = plist_get_data(nodeslist[i]); + if ((data->type == PLIST_DICT) || (data->type == PLIST_ARRAY)) { + free(data->buff); + data->buff = NULL; + } if (i == root_object) continue; node_t* node = (node_t*)nodeslist[i]; if (node && NODE_IS_ROOT(node)) { |