summaryrefslogtreecommitdiffstats
path: root/fuzz/jplist-crashes/clusterfuzz-testcase-minimized-jplist_fuzzer-5161359598288896
diff options
context:
space:
mode:
authorGravatar Nikias Bassen2026-01-20 09:52:02 +0100
committerGravatar Nikias Bassen2026-01-20 09:55:40 +0100
commitcff6a14ba4d0964c4fb4843aad84db12b4df2854 (patch)
tree7ddb25e2b98088f0fcfea345eddebe9366f39572 /fuzz/jplist-crashes/clusterfuzz-testcase-minimized-jplist_fuzzer-5161359598288896
parent001a59eef3b2a981f28af74ea82e1fc06b0c4275 (diff)
downloadlibplist-cff6a14ba4d0964c4fb4843aad84db12b4df2854.tar.gz
libplist-cff6a14ba4d0964c4fb4843aad84db12b4df2854.tar.bz2
plist: Reject insertion of plist nodes that already have a parent
Credit to @LkkkLxy for reporting (#276). libplist nodes are owned by exactly one container. Inserting the same plist_t into multiple dicts or arrays corrupts the tree structure and leads to use-after-free crashes during traversal or plist_free(). Add explicit parent checks to dict and array insertion APIs to reject nodes that already belong to another container. In debug builds, this fails loudly via assert() and optional diagnostics; in release builds, the operation safely no-ops. Callers that need to reuse values must create a copy using plist_copy() or explicitly detach the node before reinserting it.
Diffstat (limited to 'fuzz/jplist-crashes/clusterfuzz-testcase-minimized-jplist_fuzzer-5161359598288896')
0 files changed, 0 insertions, 0 deletions