oplist: Add more bound checks to prevent OOB reads
diff --git a/src/oplist.c b/src/oplist.c
index 21d8a64..deb54de 100644
--- a/src/oplist.c
+++ b/src/oplist.c
@@ -527,7 +527,7 @@
plist_t val = NULL;
while (ctx->pos < ctx->end && !ctx->err) {
parse_skip_ws(ctx);
- if (*ctx->pos == '}' || ctx->pos >= ctx->end) {
+ if (ctx->pos >= ctx->end || *ctx->pos == '}') {
break;
}
key = NULL;
@@ -541,6 +541,11 @@
break;
}
parse_skip_ws(ctx);
+ if (ctx->pos >= ctx->end) {
+ PLIST_OSTEP_ERR("EOF while parsing dictionary '=' delimiter at offset %ld\n", ctx->pos - ctx->start);
+ ctx->err++;
+ break;
+ }
if (*ctx->pos != '=') {
PLIST_OSTEP_ERR("Missing '=' while parsing dictionary item at offset %ld\n", ctx->pos - ctx->start);
ctx->err++;
@@ -565,6 +570,11 @@
break;
}
parse_skip_ws(ctx);
+ if (ctx->pos >= ctx->end) {
+ PLIST_OSTEP_ERR("EOF while parsing dictionary item terminator ';' at offset %ld\n", ctx->pos - ctx->start);
+ ctx->err++;
+ break;
+ }
if (*ctx->pos != ';') {
plist_free(val);
plist_free(key);
@@ -599,6 +609,11 @@
if (ctx->err) {
goto err_out;
}
+ if (ctx->pos >= ctx->end) {
+ PLIST_OSTEP_ERR("EOF while parsing dictionary terminator '}' at offset %ld\n", ctx->pos - ctx->start);
+ ctx->err++;
+ break;
+ }
if (*ctx->pos != '}') {
PLIST_OSTEP_ERR("Missing terminating '}' at offset %ld\n", ctx->pos - ctx->start);
ctx->err++;
@@ -615,7 +630,7 @@
plist_t tmp = NULL;
while (ctx->pos < ctx->end && !ctx->err) {
parse_skip_ws(ctx);
- if (*ctx->pos == ')') {
+ if (ctx->pos >= ctx->end || *ctx->pos == ')') {
break;
}
ctx->err = node_from_openstep(ctx, &tmp);
@@ -629,6 +644,11 @@
plist_array_append_item(subnode, tmp);
tmp = NULL;
parse_skip_ws(ctx);
+ if (ctx->pos >= ctx->end) {
+ PLIST_OSTEP_ERR("EOF while parsing array item delimiter ',' at offset %ld\n", ctx->pos - ctx->start);
+ ctx->err++;
+ break;
+ }
if (*ctx->pos != ',') {
break;
}
@@ -637,6 +657,11 @@
if (ctx->err) {
goto err_out;
}
+ if (ctx->pos >= ctx->end) {
+ PLIST_OSTEP_ERR("EOF while parsing array terminator ')' at offset %ld\n", ctx->pos - ctx->start);
+ ctx->err++;
+ break;
+ }
if (*ctx->pos != ')') {
PLIST_OSTEP_ERR("Missing terminating ')' at offset %ld\n", ctx->pos - ctx->start);
ctx->err++;
@@ -652,6 +677,11 @@
bytearray_t *bytes = byte_array_new(256);
while (ctx->pos < ctx->end && !ctx->err) {
parse_skip_ws(ctx);
+ if (ctx->pos >= ctx->end) {
+ PLIST_OSTEP_ERR("EOF while parsing data terminator '>' at offset %ld\n", ctx->pos - ctx->start);
+ ctx->err++;
+ break;
+ }
if (*ctx->pos == '>') {
break;
}
