From 26061aac4ec75e7a4469a9aab9a424716223e5c4 Mon Sep 17 00:00:00 2001 From: Wang Junjie Date: Thu, 19 Jan 2017 14:59:14 +0100 Subject: bplist: Check for invalid offset_size in bplist trailer --- src/bplist.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/bplist.c b/src/bplist.c index 881c2c8..4a00683 100644 --- a/src/bplist.c +++ b/src/bplist.c @@ -733,6 +733,9 @@ PLIST_API void plist_from_bin(const char *plist_bin, uint32_t length, plist_t * if (num_objects == 0) return; + if (offset_size == 0) + return; + if (root_object >= num_objects) return; -- cgit v1.1-32-gdbae