diff options
| author |  Nikias Bassen | 2015-01-31 20:19:40 +0100 |
|---|---|---|
| committer | Nikias Bassen | 2015-01-31 20:19:40 +0100 |
| commit | 9da6e82da3552daf27bf50cc3308bdac886dc28d (patch) | |
| tree | d5b1b6875e4e9ded9e1f5b7edca7a7578cce0bc3 /src | |
| parent | 3c4bf492e5211e4196de872b823370670d8c56fc (diff) | |
| download | libplist-9da6e82da3552daf27bf50cc3308bdac886dc28d.tar.gz libplist-9da6e82da3552daf27bf50cc3308bdac886dc28d.tar.bz2 | |
bplist: Fix possible crash in plist_from_bin() caused by access to already freed memory
Given a specifically ordered binary plist the function plist_from_bin() would
free BPLIST_DICT or BPLIST_ARRAY raw node data that is still required for
parsing of following nodes. This commit addresses this issues by moving the
memory free to the end of the parsing process.
Diffstat (limited to 'src')
| -rw-r--r-- | src/bplist.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/src/bplist.c b/src/bplist.c index 40b453b..cbe9481 100644 --- a/src/bplist.c +++ b/src/bplist.c @@ -720,8 +720,6 @@ PLIST_API void plist_from_bin(const char *plist_bin, uint32_t length, plist_t * node_attach(nodeslist[i], n); } } - - free(data->buff); break; case PLIST_ARRAY: @@ -738,7 +736,6 @@ PLIST_API void plist_from_bin(const char *plist_bin, uint32_t length, plist_t * node_attach(nodeslist[i], node_copy_deep(nodeslist[index1], copy_plist_data)); } } - free(data->buff); break; default: break; @@ -749,6 +746,11 @@ PLIST_API void plist_from_bin(const char *plist_bin, uint32_t length, plist_t * // free unreferenced nodes that would otherwise leak memory for (i = 0; i < num_objects; i++) { + plist_data_t data = plist_get_data(nodeslist[i]); + if ((data->type == PLIST_DICT) || (data->type == PLIST_ARRAY)) { + free(data->buff); + data->buff = NULL; + } if (i == root_object) continue; node_t* node = (node_t*)nodeslist[i]; if (node && NODE_IS_ROOT(node)) { |