summaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
authorGravatar Nikias Bassen2015-01-31 20:19:40 +0100
committerGravatar Nikias Bassen2015-01-31 20:19:40 +0100
commit9da6e82da3552daf27bf50cc3308bdac886dc28d (patch)
treed5b1b6875e4e9ded9e1f5b7edca7a7578cce0bc3 /src
parent3c4bf492e5211e4196de872b823370670d8c56fc (diff)
downloadlibplist-9da6e82da3552daf27bf50cc3308bdac886dc28d.tar.gz
libplist-9da6e82da3552daf27bf50cc3308bdac886dc28d.tar.bz2
bplist: Fix possible crash in plist_from_bin() caused by access to already freed memory
Given a specifically ordered binary plist the function plist_from_bin() would free BPLIST_DICT or BPLIST_ARRAY raw node data that is still required for parsing of following nodes. This commit addresses this issues by moving the memory free to the end of the parsing process.
Diffstat (limited to 'src')
-rw-r--r--src/bplist.c8
1 files changed, 5 insertions, 3 deletions
diff --git a/src/bplist.c b/src/bplist.c
index 40b453b..cbe9481 100644
--- a/src/bplist.c
+++ b/src/bplist.c
@@ -720,8 +720,6 @@ PLIST_API void plist_from_bin(const char *plist_bin, uint32_t length, plist_t *
node_attach(nodeslist[i], n);
}
}
-
- free(data->buff);
break;
case PLIST_ARRAY:
@@ -738,7 +736,6 @@ PLIST_API void plist_from_bin(const char *plist_bin, uint32_t length, plist_t *
node_attach(nodeslist[i], node_copy_deep(nodeslist[index1], copy_plist_data));
}
}
- free(data->buff);
break;
default:
break;
@@ -749,6 +746,11 @@ PLIST_API void plist_from_bin(const char *plist_bin, uint32_t length, plist_t *
// free unreferenced nodes that would otherwise leak memory
for (i = 0; i < num_objects; i++) {
+ plist_data_t data = plist_get_data(nodeslist[i]);
+ if ((data->type == PLIST_DICT) || (data->type == PLIST_ARRAY)) {
+ free(data->buff);
+ data->buff = NULL;
+ }
if (i == root_object) continue;
node_t* node = (node_t*)nodeslist[i];
if (node && NODE_IS_ROOT(node)) {