From 088cdab964e6cd88b7f15f36eb3e08d38189cd21 Mon Sep 17 00:00:00 2001 From: Nikias Bassen Date: Fri, 28 Jan 2022 22:11:00 +0100 Subject: jplist: Fix NULL pointer dereference by handling errors from unescape_string correctly Credit to OSS-Fuzz --- src/jplist.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'src') diff --git a/src/jplist.c b/src/jplist.c index ace4bff..c149d20 100644 --- a/src/jplist.c +++ b/src/jplist.c @@ -549,6 +549,9 @@ static plist_t parse_string(const char* js, jsmntok_t* tokens, int* index) size_t str_len = 0; ; char* strval = unescape_string(js + tokens[*index].start, tokens[*index].end - tokens[*index].start, &str_len); + if (!strval) { + return NULL; + } plist_t node; plist_data_t data = plist_new_plist_data(); @@ -612,6 +615,9 @@ static plist_t parse_object(const char* js, jsmntok_t* tokens, int* index) for (num = 0; num < num_tokens; num++) { if (tokens[j].type == JSMN_STRING) { char* key = unescape_string(js + tokens[j].start, tokens[j].end - tokens[j].start, NULL); + if (!key) { + return NULL; + } plist_t val = NULL; j++; num++; -- cgit v1.1-32-gdbae