summaryrefslogtreecommitdiffstats
path: root/src/xplist.c
AgeCommit message (Collapse)AuthorFilesLines
2016-10-31xplist: Prevent heap buffer overflow when parsing empty tagsGravatar Filippo Bigarella1-1/+3
If `ctx->pos - p - 1` is greater than `taglen`, we end up writing outside the buffer pointed to by `tag`. This commit fixes it by checking the bounds of the heap buffer before writing.
2016-10-31xplist: Prevent NULL pointer dereference when parsing <real> nodesGravatar Filippo Bigarella1-0/+8
2016-10-22Remove libxml2 dependency in favor of custom XML parsingGravatar Nikias Bassen1-350/+652
2016-09-19Use time64 implementation by Michael G Schwern to extend allowed date/time rangeGravatar Nikias Bassen1-11/+17
The main benefit of this is to allow date/time values outside of the 32bit time_t range which is very important on 32bit platforms. But there are also some other issues that will be fixed with this, for example on macOS, mktime() will not work for dates < 1902 despite time_t being 64bit. In the same run this commit will also use a reentrant version of gmtime64_r that should help in multithreaded scenarios. Original code taken from: https://github.com/evalEmpire/y2038
2016-09-19Change internal storage of PLIST_DATE values from struct timeval to doubleGravatar Nikias Bassen1-4/+3
This removes the timeval union member from the plist_data_t structure. Since struct timeval is 2x64bit on 64bit platforms this member unnecessarily grew the union size to 16 bytes while a size of 8 bytes is sufficient. Also, on 32bit platforms struct timeval is only 2x32bit of size, limiting the range of possible time values. In addition the binary property list format also stores PLIST_DATE nodes as double.
2016-06-29xplist: Plug memory leak when converting PLIST_UID nodes to XMLGravatar Nikias Bassen1-0/+1
In node_to_xml nodes of type PLIST_UID are temporarily converted to a PLIST_DICT for an appropriate XML output. Therefore a PLIST_KEY and a PLIST_UINT node is created and inserted into the PLIST_DICT node. Upon completion, the child nodes of the PLIST_DICT node are detached from the original node and freed, however the data of the child nodes - the key string and the uint value - are not. This commit fixes it.
2016-04-20Move libxml cleanup code to a plist_cleanup methodGravatar Frederik Carlier1-17/+0
2015-11-13xplist: Get rid of setlocale() and use custom function to print floating ↵Gravatar Nikias Bassen1-14/+32
point values
2015-01-23xplist: Plug memory leak by cleaning up libxml2's parser after useGravatar Martin Szulecki1-0/+16
This is actually considered bad practice. However, it appears this memory leak is otherwise not possible to fix due to a design flaw in how libxml2 handles the lifecycle of it's XML parser. We'll let the community test this in production now and decide. In our tests this change had no drawbacks except fixing the last known memory leak in libplist.
2015-01-23Update and correct some copyright header commentsGravatar Martin Szulecki1-1/+3
2015-01-23xplist: Fix limited but possible XXE security vulnerability with XML plistsGravatar Martin Szulecki1-4/+16
By using a specifically crafted XML file an attacker could use plistutil to issue a GET request to an arbitrary URL or disclose a local file. The crafted XML file would be using a custom DTD with an external entity reference pointing to the file. Practical abuse is limited but let's still fix it nevertheless. Related to CVE-2013-0339 for libxml2 and CWE-827. Reported by Loïc Bénis from calypt.com. Thanks!
2014-10-03Avoid exporting non-public symbolsGravatar Nikias Bassen1-2/+2
2014-08-25Fixed memory leaks in new_xml_plist() and parse_real_node().Gravatar Aaron Burghardt1-3/+0
2014-05-27xplist: Fix keys not being output correctly if converted to XML entitiesGravatar Martin Szulecki1-5/+11
2014-05-23Handle signed vs. unsigned integer values correctlyGravatar Nikias Bassen1-3/+28
2014-05-22xplist: Handle DST-affected timezones correctlyGravatar Nikias Bassen1-1/+1
2014-05-22xplist: Fix PLIST_DATE handling to respect the Mac epochGravatar Nikias Bassen1-2/+4
2014-05-21xplist: Fix PLIST_DATE parsing in xml_to_node()Gravatar Nikias Bassen1-1/+1
2014-05-18xplist: Silence compiler warnings about shadowing global declarationsGravatar Nikias Bassen1-8/+8
2014-04-01xplist: Fix timezone-bound date/time conversionGravatar Nikias Bassen1-1/+4
2013-12-13xplist: fix another compiler warning with castGravatar Nikias Bassen1-1/+1
2013-12-13xplist: silence compiler warningGravatar Nikias Bassen1-1/+1
2013-12-13xplist: fix shadowed variable declarationGravatar Nikias Bassen1-3/+3
2013-03-07xml plists: make sure we don't produce <data/> if it's emptyGravatar Nikias Bassen1-0/+9
2012-11-08Fix crash when converting plists containing commentsGravatar Nikias Bassen1-0/+4
Thanks to free2000fly for pointing this out. The issue was that XML plists with comments converted to binary plists would result in invalid binary nodes, thus converting back these binary plists resulted in a crash.
2012-09-16xplist: set DST to not available in parse_date()Gravatar Nikias Bassen1-0/+1
2012-09-16implemented handling of UID keyed encoding typeGravatar Nikias Bassen1-0/+55
2012-01-12fix compiler warningsGravatar Nikias Bassen1-1/+1
2011-05-29Use simple sscanf for parsing dates if strptime is not availableGravatar Nikias Bassen1-2/+15
2011-05-29Use malloc+snprintf instead of asprintfGravatar Nikias Bassen1-2/+4
2011-05-27Make libplist glib freeGravatar Nikias Bassen1-24/+61
2010-08-23Fixes the xml export.Gravatar Dogbert1-2/+2
Apple's activation server refuses XML tickets when this patch isn't applied.
2010-04-06plist_to_xml: use POSIX locale to make sure '.' is used for floatsGravatar Nikias Bassen1-0/+14
In locales like German, a ',' is used as a decimal separator. When the program calling plist_to_xml uses LC_NUMBER with something different than a '.', parsing of the resulting XML document fails. This patch fixes it.
2010-04-06plist_to_xml: copy terminating 0-byte given from xmlDocDumpMemoryGravatar Nikias Bassen1-2/+3
This makes it possible to process the resulting char* directly as a c-string without further copying.
2010-03-03Copy xml buffer to malloced buffer to prevent free / xmlFree mixing.Gravatar Jonathan Beck1-2/+9
2010-01-21Fix some warningsGravatar Jonathan Beck1-1/+2
2010-01-14Make sure to convert predefined xml entities in xml outputGravatar Martin Szulecki1-1/+6
For string nodes, a set of special characters must be converted to predefined xml entities. This patch adds an entitiy test case for this and makes libplist pass it fine by explicitly adding text nodes.
2009-10-28Format sources to ANSI style using AStyle (astyle --style=ansi).Gravatar Jonathan Beck1-272/+292
2009-07-08Add a deep copy function and value setters for nodes.Gravatar Jonathan Beck1-6/+4
2009-04-28Merge ascii and unicode handling in PLIST_STRING using UTF-8. Remove unicode ↵Gravatar Jonathan Beck1-24/+3
related declaration in API (breaks API&ABI)
2009-03-27Use (void) instead of () in functions prototype.Gravatar Jonathan Beck1-1/+1
2009-02-15Add more regression test and fix Integer and Real type handling.Gravatar Jonathan Beck1-2/+2
2009-02-14Fix Invalid memory read and match g_free with g_malloc.Gravatar Jonathan Beck1-3/+3
2009-02-14Fix some memory leaks.Gravatar Jonathan Beck1-26/+26
2009-02-14Only call g_base64_encode if there is data to encode.Gravatar Jonathan Beck1-3/+5
2009-02-09Make it compile on MSVC 2005.Gravatar Jonathan Beck1-21/+42
2009-01-29Fix indent.Gravatar Jonathan Beck1-6/+5
2009-01-29Clean some old stuff.Gravatar Jonathan Beck1-2/+0
2009-01-29Add some static declarations.Gravatar Jonathan Beck1-3/+5
2009-01-22Add Unicode support.Gravatar Jonathan Beck1-6/+27
© 2009-2020 sukimashita.com - Generated by cgit - Icons from Tango - Uses Google Analytics