diff options
| -rw-r--r-- | src/bplist.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/src/bplist.c b/src/bplist.c index da7bb63..0fd149e 100644 --- a/src/bplist.c +++ b/src/bplist.c | |||
| @@ -825,6 +825,11 @@ PLIST_API void plist_from_bin(const char *plist_bin, uint32_t length, plist_t * | |||
| 825 | return; | 825 | return; |
| 826 | } | 826 | } |
| 827 | 827 | ||
| 828 | if (num_objects * offset_size < num_objects) { | ||
| 829 | PLIST_BIN_ERR("integer overflow when calculating offset table size (too many objects)\n"); | ||
| 830 | return; | ||
| 831 | } | ||
| 832 | |||
| 828 | if (offset_table + num_objects * offset_size > end_data) { | 833 | if (offset_table + num_objects * offset_size > end_data) { |
| 829 | PLIST_BIN_ERR("offset table points outside of valid range\n"); | 834 | PLIST_BIN_ERR("offset table points outside of valid range\n"); |
| 830 | return; | 835 | return; |
