| Age | Commit message (Collapse) | Author | Files | Lines |
|---|
|
Found by failing each allocation in turn under ASan/UBSan/LSan:
- plist_free() leaked the whole tree if its work stack could not be
allocated; free the children iteratively without extra memory
- plist_copy(): when a shallow copy of a dict/array failed, the original's
lookup table was freed along with the copy's data (use-after-free)
- bplist parser: fix a NULL dereference in parse_date_node(), check the
node_attach() results, and don't leak on failure; plist_to_bin() no
longer leaks on an allocation failure
- free the plist data when node creation fails (plist constructors, XML,
JSON and binary parsers)
|
|
- check malloc/calloc/realloc results in constructors, the JSON and
OpenStep writers, the XML text-part helpers and base64 decoding, and
return PLIST_ERR_NO_MEM instead of asserting or dereferencing NULL
- guard size calculations against overflow in the UTF-8/UTF-16BE
conversions, ptrarray, and bytearray
- make hash_table_insert() report failure instead of silently dropping
the entry; writers propagate PLIST_ERR_NO_MEM, and dict lookup caches
are discarded so lookups fall back to a linear search
- don't overwrite an earlier parse error code in the XML parser, and
report PLIST_ERR_NO_MEM when reading text content fails for lack of memory
- OpenStep parser: check node/data/string allocations and dict/array
insertion results
Based on #323 by bg0d-droid.
Co-authored-by: bg0d-droid <81825610+bg0d-droid@users.noreply.github.com>
|
|
byte_array_grow() assigned the result of realloc() directly to
ba->data and increased the capacity even if realloc() failed, so the
following memcpy() in byte_array_append() wrote to NULL + len.
On failure, free the old buffer and leave the byte array in a failed
state (data == NULL), which byte_array_append() already ignores. The
callers check for that state:
- the writers (bin, xml, json, openstep and the text output formats)
return PLIST_ERR_NO_MEM instead of handing out a NULL/truncated buffer
- node_to_xml() base64-encodes <data> directly into the grown buffer,
so it must bail out there (only guarded by assert() before)
- the OpenStep parser returns PLIST_ERR_NO_MEM for <hex data> instead of
silently returning truncated data
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
|
|
|
Avoid undefined behavior when serializing malformed PLIST_DATE values
containing NaN, infinity, or values outside the Time64_T range. Add a
shared helper for checked date conversion and use it across writer paths.
|
|
|
|
- Add PLIST_OPT_COERCE option to coerce PLIST_DATE, PLIST_DATA, and PLIST_UID to JSON-compatible types (ISO 8601 strings, Base64 strings, and integers)
- Add plist_to_json_with_options() function to allow passing coercion options (and others)
- Update plist_write_to_string() and plist_write_to_stream() to support coercion option
- Add --coerce flag to plistutil for JSON output
- Create plist2json symlink that automatically enables coercion when invoked
|
|
|
|
|
|
|
|
Use size_t for token start/end offsets instead of int, replace the -1
sentinel with SIZE_MAX, and add a defensive guard against offset
wraparound. This prevents overflow when parsing very large JSON inputs.
This addresses issue #282.
Credit to @ylwango613 for repporting.
|
|
Thanks to @unbengable12 for reporting. Addresses #288, #289, #290, #291, and #292.
|
|
Thanks to @LkkkLxy for pointing out the issue.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
the format parses
This makes the `-d` option work in plistutil that wasn't doing anything
|
|
This makes the code more readable. Obviously all the code that uses it
is also updated.
|
|
|
|
|
|
This properly supports getting and setting signed or unsigned integer values.
Also, a new helper function plist_int_val_is_negative() was added to determine if
a given #PLIST_INT node has a negative value or not.
The old type PLIST_UINT is defined as a macro with the value of PLIST_INT for
backwards compatibility.
This commit also adds int vs. uint support to the C++ interface, and the python
bindings in a hopefully useful way.
|
|
|
|
Found by CodeQL
|
|
|
|
|
|
Credit to OSS-Fuzz
|
|
Credit to OSS-Fuzz
|
|
Credit to OSS-Fuzz
|
|
Credit to OSS-Fuzz
|
|
Credit to OSS-Fuzz
|
|
Credit to OSS-Fuzz
|
|
Instead of calling strtoll() and atof(), the code now parses the numerical
values directly to handle cases of non-0-terminated string data.
The floating point value parsing is probably not ideal, but sufficient for
our purposes.
|
|
Credit to OSS-Fuzz
|
|
In parse_primitive, integer and double values are parsed by using strtoll
and atof, which both expect the string to be 0-terminated. While this is
not a problem in well-formed JSON files, it can be if the JSON data is not,
possibly leading to a crash due to OOB memory access.
This commit fixes it by copying the value data in question to a stack buffer
and 0-terminate it, and use that buffer instead.
Credit to OSS-Fuzz
|
|
Credit to OSS-Fuzz
|
|
Credit to OSS-Fuzz
|
|
correctly
Credit to OSS-Fuzz
|
|
Credit to OSS-Fuzz
|
|
|
|
|
|
This way the string doesn't have to be 0-terminated.
|
|
|
|
|
|
|
Nikias Bassen
Comtea04
Calil Khalil
Duncan Ogilvie