tree 5fa4d3413c92a5e2b4650689c46bf6a47c0b401a
parent 72f7cf803635a127c63bcd37ab35ced28636410a
author Nikias Bassen <nikias@gmx.li> 1486730566 +0100
committer Nikias Bassen <nikias@gmx.li> 1486730566 +0100

bplist: Fix data range check for string/data/dict/array nodes

Passing a size of 0xFFFFFFFFFFFFFFFF to parse_string_node() might result
in a memcpy with a size of -1, leading to undefined behavior.
This commit makes sure that the actual node data (which depends on the size)
is in the range start_of_object..start_of_object+size.

Credit to OSS-Fuzz