Age | Commit message (Collapse) | Author | Files | Lines | |
---|---|---|---|---|---|
2017-02-07 | plist: Fix assert() to allow 16 or 8 byte integer sizes (16 bytes = unsigned ↵ | Nikias Bassen | 1 | -1/+1 | |
integer) Credit to Wang Junjie <zhunkibatu@gmail.com> (#90) Credit to OSS-Fuzz | |||||
2017-02-07 | bplist: Properly handle some more malloc() failure situations | Nikias Bassen | 1 | -3/+18 | |
2017-02-07 | bplist: Make sure to bail out if malloc() fails in parse_unicode_node() | Nikias Bassen | 1 | -0/+5 | |
Credit to OSS-Fuzz | |||||
2017-02-07 | bplist: Make sure to bail out if malloc() fails in parse_data_node() | Nikias Bassen | 1 | -0/+5 | |
Credit to OSS-Fuzz | |||||
2017-02-07 | bplist: Make sure to bail out if malloc() fails in parse_string_node() | Nikias Bassen | 1 | -0/+5 | |
Credit to Wang Junjie <zhunkibatu@gmail.com> (#93) | |||||
2017-02-07 | xplist: Prevent some more strncmp related OOB reads | Nikias Bassen | 1 | -4/+4 | |
2017-02-07 | xplist: Really fix OOB read when parsing DOCTYPE | Nikias Bassen | 1 | -1/+1 | |
2017-02-07 | xplist: unescape_entities(): Make sure text part buffer is null terminated ↵ | Nikias Bassen | 1 | -0/+1 | |
after strncpy | |||||
2017-02-07 | xplist: Fix OOB read when parsing DOCTYPE | Nikias Bassen | 1 | -1/+1 | |
2017-02-07 | xplist: Also fix OOB read in find_char() and find_str() functions | Nikias Bassen | 1 | -0/+8 | |
2017-02-07 | xplist: Prevent OOB read in two more cases | Nikias Bassen | 1 | -0/+10 | |
2017-02-07 | xplist: Fix OOB read when parsing double quotes | Nikias Bassen | 1 | -0/+4 | |
2017-02-07 | xplist: Fix OOB read when parsing node text content | Nikias Bassen | 1 | -1/+1 | |
2017-02-07 | xplist: Catch some more error conditions | Nikias Bassen | 1 | -34/+37 | |
2017-02-06 | xplist: Prevent memory leaks when parsing fails | Nikias Bassen | 1 | -37/+20 | |
2017-02-06 | bplist: Plug memory leak in case parsing a dictionary key fails | Nikias Bassen | 1 | -0/+1 | |
2017-02-06 | bplist: Refine some debug/error messages in parse_dict_node() | Nikias Bassen | 1 | -4/+4 | |
2017-02-05 | bplist: Suppress compiler warnings about format specifiers in error messages | Nikias Bassen | 1 | -8/+9 | |
2017-02-05 | bplist: Add error/debug logging (only if configured with --enable-debug) | Nikias Bassen | 2 | -31/+116 | |
This commit adds proper debug/error messages being printed if the binary plist parser encounters anything abnormal. To enable debug logging, libplist must be configured with --enable-debug, and the environment variable PLIST_BIN_DEBUG must be set to "1". | |||||
2017-02-05 | bplist: Make sure node data is always before the offset table | Nikias Bassen | 1 | -14/+14 | |
2017-02-05 | bplist: Make sure the offset table is in the correct range | Nikias Bassen | 1 | -4/+9 | |
2017-02-05 | bplist: Make sure node index is smaller than number of objects | Nikias Bassen | 1 | -1/+1 | |
2017-02-04 | bplist: Fix OOB write on heap buffer and improve recursion check | Nikias Bassen | 1 | -8/+14 | |
Issue #92 pointed out an problem with (invalid) bplist files which have exactly one structured node whose subnode reference itself. The recursion check used a fixed size array with the size of the total number of objects. In this case the number of objects is 1 but the recursion check code wanted to set the node_index for the level 1 which leads to an OOB write on the heap. This commit fixes/improves two things: 1) Prevent OOB write by using a dynamic data storage for the used node indexes (plist_t of type PLIST_ARRAY) 2) Reduces the memory usage of large binary plists, because not the total number of nodes in the binary plist, but the number of recursion levels is important for the recursion check. | |||||
2017-02-03 | bplist: Prevent OOB read when parsing data/string/array/dict size nodes | Nikias Bassen | 1 | -0/+2 | |
As reported in #91, the code that will read the big endian integer value of variable size did not check if the actual number of bytes is still withing the range of the actual plist data. This commit fixes the issue with proper bounds checking. | |||||
2017-02-03 | bplist: Unify size node parsing for data/string/array/dict nodes | Nikias Bassen | 1 | -45/+24 | |
2017-02-01 | bplist: Fix possible out-of-bounds read in parse_array_node() with proper ↵ | Nikias Bassen | 1 | -4/+12 | |
bounds checking | |||||
2017-02-01 | bplist: Avoid heap buffer allocation when parsing array/dict/string/data ↵ | Nikias Bassen | 1 | -20/+25 | |
node sizes > 14 The sizes where effectively parsed by calling parse_uint_node() which allocates a node_t (along with plist_data_t) that is immediately freed after retrieving the integer value it holds. This commit changes the code to directly operate on the binary stream to 'just' read the size instead, reducing the memory footprint further. | |||||
2017-01-28 | bplist: Don't duplicate output buffer in plist_to_bin() | Nikias Bassen | 1 | -4/+4 | |
2017-01-28 | bplist: Improve parsing unicode nodes | Nikias Bassen | 1 | -23/+10 | |
2017-01-28 | bplist: Improve writing of offset table | Nikias Bassen | 1 | -12/+3 | |
2017-01-28 | bplist: Improve writing of array and dictionary nodes | Nikias Bassen | 1 | -54/+17 | |
2017-01-28 | bplist: Improve writing of data, string, and unicode nodes | Nikias Bassen | 1 | -18/+7 | |
2017-01-28 | bplist: Improve writing of UID nodes | Nikias Bassen | 1 | -12/+6 | |
2017-01-28 | bplist: Improve writing of integer nodes | Nikias Bassen | 1 | -21/+12 | |
2017-01-28 | bplist: Improve real/date node de/serialization | Nikias Bassen | 1 | -65/+56 | |
2017-01-25 | bplist: Fix UID node parsing to match Apple's parser | Nikias Bassen | 1 | -14/+7 | |
Apple only allows 32 bit unsigned values for UID nodes. Also the encoding of the length is different from the encoding used for other node types. The nibble used to mark the size is 1 less than the actual size of the integer value data, so 0 means 1 byte length 1 means 2 bytes length, etc. | |||||
2017-01-25 | bplist: Improve integer node parsing, remove unnecessary memcpy() | Nikias Bassen | 1 | -4/+2 | |
2017-01-19 | bplist: Check for invalid ref_size in bplist trailer | Nikias Bassen | 1 | -0/+3 | |
2017-01-19 | bplist: Mass-rename 'dict_size' and 'param_dict_size' to more appropriate ↵ | Nikias Bassen | 1 | -30/+30 | |
'ref_size' | |||||
2017-01-19 | bplist: Use proper struct for binary plist trailer | Nikias Bassen | 1 | -47/+31 | |
2017-01-19 | bplist: Check for invalid offset_size in bplist trailer | Wang Junjie | 1 | -0/+3 | |
2017-01-18 | bplist: Improve UINT_TO_HOST macro, remove uint24_from_be function | Nikias Bassen | 1 | -17/+11 | |
The uint24_from_be function used memcpy and a call to byte_convert. Instead the macro now shifts the data appropriately with a new beNtoh macro that eventually uses be64toh. This commit also fixes the problem where binary plist data with other non-power-of-2 sizes (like 5,6, or 7) where not handled correctly, and actually supports sizes larger than 8 bytes though only the last 8 bytes are actually converted (nobody will come up with such a large plist anyway). | |||||
2017-01-16 | bplist: Disallow key nodes with non-string node types | Nikias Bassen | 1 | -0/+7 | |
As reported in #86, the binary plist parser would force the type of the key node to be of type PLIST_KEY while the node might be of a different i.e. non-string type. A following plist_free() might then call free() on an invalid pointer; e.g. if the node is of type integer, its value would be considered a pointer, and free() would cause an error. We prevent this issue by disallowing non-string key nodes during parsing. | |||||
2017-01-11 | base64: Rework base64decode to handle split encoded data correctly | Nikias Bassen | 1 | -41/+27 | |
2017-01-03 | xplist: Refine XML parsing error messages | Nikias Bassen | 1 | -15/+18 | |
2017-01-03 | time64: Remove some unused (and non-thread-safe) functions | Nikias Bassen | 2 | -28/+0 | |
2017-01-03 | win32: Try to prevent linking against libgcc_s_dw2 | Nikias Bassen | 1 | -2/+2 | |
While this works for libplist.dll, libplist++.dll will still have the _Unwind_Resume symbol being imported from libgcc_s_dw2-1.dll and there doesn't seem to be a way to prevent that. | |||||
2017-01-02 | xplist: Error out when invalid tags inside text nodes are encountered | Nikias Bassen | 1 | -2/+12 | |
2017-01-02 | xplist: Make sure to error out when encountering empty/incomplete entities | Nikias Bassen | 1 | -1/+5 | |
2017-01-02 | xplist: Make sure to not parse for entities in empty strings | Nikias Bassen | 1 | -1/+1 | |