From 6a44dfb72f1cb5c82c10feed95ff9428eec49d0a Mon Sep 17 00:00:00 2001 From: Nikias Bassen Date: Thu, 19 Jan 2017 17:44:42 +0100 Subject: bplist: Check for invalid ref_size in bplist trailer --- src/bplist.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/src/bplist.c b/src/bplist.c index 7ab9380..7cc8a03 100644 --- a/src/bplist.c +++ b/src/bplist.c @@ -727,6 +727,9 @@ PLIST_API void plist_from_bin(const char *plist_bin, uint32_t length, plist_t * if (offset_size == 0) return; + if (ref_size == 0) + return; + if (root_object >= num_objects) return; -- cgit v1.1-32-gdbae