summaryrefslogtreecommitdiffstats
AgeCommit message (Collapse)AuthorFilesLines
2017-02-05bplist: Make sure node data is always before the offset tableGravatar Nikias Bassen1-14/+14
2017-02-05bplist: Make sure the offset table is in the correct rangeGravatar Nikias Bassen1-4/+9
2017-02-05bplist: Make sure node index is smaller than number of objectsGravatar Nikias Bassen1-1/+1
2017-02-04bplist: Fix OOB write on heap buffer and improve recursion checkGravatar Nikias Bassen1-8/+14
Issue #92 pointed out an problem with (invalid) bplist files which have exactly one structured node whose subnode reference itself. The recursion check used a fixed size array with the size of the total number of objects. In this case the number of objects is 1 but the recursion check code wanted to set the node_index for the level 1 which leads to an OOB write on the heap. This commit fixes/improves two things: 1) Prevent OOB write by using a dynamic data storage for the used node indexes (plist_t of type PLIST_ARRAY) 2) Reduces the memory usage of large binary plists, because not the total number of nodes in the binary plist, but the number of recursion levels is important for the recursion check.
2017-02-03bplist: Prevent OOB read when parsing data/string/array/dict size nodesGravatar Nikias Bassen1-0/+2
As reported in #91, the code that will read the big endian integer value of variable size did not check if the actual number of bytes is still withing the range of the actual plist data. This commit fixes the issue with proper bounds checking.
2017-02-03bplist: Unify size node parsing for data/string/array/dict nodesGravatar Nikias Bassen1-45/+24
2017-02-01bplist: Fix possible out-of-bounds read in parse_array_node() with proper ↵Gravatar Nikias Bassen1-4/+12
bounds checking
2017-02-01test: Add test cases for different bplist offset and reference sizesGravatar Nikias Bassen20-0/+34
2017-02-01bplist: Avoid heap buffer allocation when parsing array/dict/string/data ↵Gravatar Nikias Bassen1-20/+25
node sizes > 14 The sizes where effectively parsed by calling parse_uint_node() which allocates a node_t (along with plist_data_t) that is immediately freed after retrieving the integer value it holds. This commit changes the code to directly operate on the binary stream to 'just' read the size instead, reducing the memory footprint further.
2017-01-28Suppress compiler warning with new bplist codeGravatar Nikias Bassen1-1/+1
2017-01-28bplist: Don't duplicate output buffer in plist_to_bin()Gravatar Nikias Bassen1-4/+4
2017-01-28bplist: Improve parsing unicode nodesGravatar Nikias Bassen1-23/+10
2017-01-28bplist: Improve writing of offset tableGravatar Nikias Bassen1-12/+3
2017-01-28bplist: Improve writing of array and dictionary nodesGravatar Nikias Bassen1-54/+17
2017-01-28bplist: Improve writing of data, string, and unicode nodesGravatar Nikias Bassen1-18/+7
2017-01-28bplist: Improve writing of UID nodesGravatar Nikias Bassen1-12/+6
2017-01-28bplist: Improve writing of integer nodesGravatar Nikias Bassen1-21/+12
2017-01-28bplist: Improve real/date node de/serializationGravatar Nikias Bassen1-65/+56
2017-01-25bplist: Fix UID node parsing to match Apple's parserGravatar Nikias Bassen1-14/+7
Apple only allows 32 bit unsigned values for UID nodes. Also the encoding of the length is different from the encoding used for other node types. The nibble used to mark the size is 1 less than the actual size of the integer value data, so 0 means 1 byte length 1 means 2 bytes length, etc.
2017-01-25bplist: Improve integer node parsing, remove unnecessary memcpy()Gravatar Nikias Bassen1-4/+2
2017-01-19bplist: Check for invalid ref_size in bplist trailerGravatar Nikias Bassen1-0/+3
2017-01-19bplist: Mass-rename 'dict_size' and 'param_dict_size' to more appropriate ↵Gravatar Nikias Bassen1-30/+30
'ref_size'
2017-01-19bplist: Use proper struct for binary plist trailerGravatar Nikias Bassen1-47/+31
2017-01-19bplist: Check for invalid offset_size in bplist trailerGravatar Wang Junjie1-0/+3
2017-01-18bplist: Improve UINT_TO_HOST macro, remove uint24_from_be functionGravatar Nikias Bassen1-17/+11
The uint24_from_be function used memcpy and a call to byte_convert. Instead the macro now shifts the data appropriately with a new beNtoh macro that eventually uses be64toh. This commit also fixes the problem where binary plist data with other non-power-of-2 sizes (like 5,6, or 7) where not handled correctly, and actually supports sizes larger than 8 bytes though only the last 8 bytes are actually converted (nobody will come up with such a large plist anyway).
2017-01-18plistutil: Use plist_is_binary() to check for binary plist dataGravatar Nikias Bassen1-1/+1
2017-01-18plistutil: Prevent OOB heap buffer read by checking input sizeGravatar Nikias Bassen1-0/+6
As pointed out in #87 plistutil would do a memcmp with a heap buffer without checking the size. If the size is less than 8 it would read beyond the bounds of this heap buffer. This commit prevents that.
2017-01-16bplist: Disallow key nodes with non-string node typesGravatar Nikias Bassen1-0/+7
As reported in #86, the binary plist parser would force the type of the key node to be of type PLIST_KEY while the node might be of a different i.e. non-string type. A following plist_free() might then call free() on an invalid pointer; e.g. if the node is of type integer, its value would be considered a pointer, and free() would cause an error. We prevent this issue by disallowing non-string key nodes during parsing.
2017-01-11base64: Rework base64decode to handle split encoded data correctlyGravatar Nikias Bassen1-41/+27
2017-01-03xplist: Refine XML parsing error messagesGravatar Nikias Bassen1-15/+18
2017-01-03time64: Remove some unused (and non-thread-safe) functionsGravatar Nikias Bassen2-28/+0
2017-01-03win32: Try to prevent linking against libgcc_s_dw2Gravatar Nikias Bassen1-2/+2
While this works for libplist.dll, libplist++.dll will still have the _Unwind_Resume symbol being imported from libgcc_s_dw2-1.dll and there doesn't seem to be a way to prevent that.
2017-01-02test: Add some more test cases for various valid and invalid contentGravatar Nikias Bassen7-1/+62
2017-01-02test: Add new test case for dictionaries with empty keysGravatar Nikias Bassen3-1/+22
2017-01-02test: Add new test case for entitiesGravatar Nikias Bassen3-1/+71
2017-01-02xplist: Error out when invalid tags inside text nodes are encounteredGravatar Nikias Bassen1-2/+12
2017-01-02xplist: Make sure to error out when encountering empty/incomplete entitiesGravatar Nikias Bassen1-1/+5
2017-01-02xplist: Make sure to not parse for entities in empty stringsGravatar Nikias Bassen1-1/+1
2017-01-02xplist: Allow empty keys in dictionariesGravatar Nikias Bassen1-2/+2
2017-01-02xplist: Allow whitespace after name in closing tagGravatar Nikias Bassen1-2/+7
'</key >' is a perfectly valid closing tag and so is '</key >' (note the newline). This commit will make the parser skip any encountered whitespace before checking for the closing '>'.
2017-01-01xplist: Fix numerical character entity conversionGravatar Nikias Bassen1-2/+6
2016-12-27Remove unused AC_SUBST for WINDRESGravatar Nikias Bassen1-1/+0
2016-12-27Remove check for pthread on macOS to suppress clang compiler warningGravatar Nikias Bassen1-10/+8
2016-12-21xplist: Fix UaF in code checking for closing tagGravatar Nikias Bassen1-2/+2
2016-12-21xplist: Make sure to correctly parse for closing tags of structured nodesGravatar Nikias Bassen1-7/+45
2016-12-21xplist: Make sure to stop parsing on entity errorsGravatar Nikias Bassen1-7/+11
2016-12-14xplist: Remove usage of strlen() wherever possibleGravatar Nikias Bassen1-45/+66
2016-12-14xplist: Improve text content parsing, reducing memory usage and unneeded copyingGravatar Nikias Bassen1-113/+318
2016-12-14Properly check for the availability of strptime() and make sure to use itGravatar Nikias Bassen2-2/+6
2016-12-14base64: Prevent use of strlen() in base64decode when input buffer size is knownGravatar Nikias Bassen1-7/+8
© 2009-2020 sukimashita.com - Generated by cgit - Icons from Tango - Uses Google Analytics