commit 47d02dde60b4c709d579aa22187ac55524485b97
author Nikias Bassen <nikias@gmx.li> Thu Feb 09 13:26:15 2017 +0100
committer Nikias Bassen <nikias@gmx.li> Thu Feb 09 13:26:15 2017 +0100
tree 6bb91d6aff257b794233786f6c100b6ddda01664
parent 1bf28fb685f0ec46db3495004fa5fadb3d9d10ad

xplist: Prevent assert when parsing CF$UID dict with invalid value node

Credit to OSS-Fuzz

src/xplist.c

diff --git a/src/xplist.c b/src/xplist.c
index 5f63a94..f5ddddd 100644
--- a/src/xplist.c
+++ b/src/xplist.c
@@ -1178,6 +1178,11 @@
                             plist_t uid = plist_dict_get_item(subnode, "CF$UID");
                             if (uid) {
                                 uint64_t val = 0;
+                                if (plist_get_node_type(uid) != PLIST_UINT) {
+                                    ctx->err++;
+                                    PLIST_XML_ERR("Invalid node type for CF$UID dict entry (must be PLIST_UINT)\n");
+                                    goto err_out;
+                                }
                                 plist_get_uint_val(uid, &val);
                                 plist_dict_remove_item(subnode, "CF$UID");
                                 plist_data_t nodedata = plist_get_data((node_t*)subnode);