commit 8e51cdc2c2bcd3bbed629ce76be055147c9ddbed
author Nikias Bassen <nikias@gmx.li> Sun Feb 05 05:16:09 2017 +0100
committer Nikias Bassen <nikias@gmx.li> Sun Feb 05 05:16:09 2017 +0100
tree f450b937a2a0407504f1ac3fcd89963234c3209d
parent 2c44cd6e7d3b961dd237b74a24cbaa80b3efc7a9

bplist: Make sure the offset table is in the correct range

src/bplist.c

diff --git a/src/bplist.c b/src/bplist.c
index d83f700..cdfea80 100644
--- a/src/bplist.c
+++ b/src/bplist.c
@@ -679,7 +679,9 @@
     uint8_t ref_size = 0;
     uint64_t num_objects = 0;
     uint64_t root_object = 0;
-    char *offset_table = NULL;
+    const char *offset_table = NULL;
+    const char *start_data = NULL;
+    const char *end_data = NULL;
 
     //first check we have enough data
     if (!(length >= BPLIST_MAGIC_SIZE + BPLIST_VERSION_SIZE + sizeof(bplist_trailer_t)))
@@ -691,8 +693,11 @@
     if (memcmp(plist_bin + BPLIST_MAGIC_SIZE, BPLIST_VERSION, BPLIST_VERSION_SIZE) != 0)
         return;
 
+    start_data = plist_bin + BPLIST_MAGIC_SIZE + BPLIST_VERSION_SIZE;
+    end_data = plist_bin + length - sizeof(bplist_trailer_t);
+
     //now parse trailer
-    trailer = (bplist_trailer_t*)(plist_bin + (length - sizeof(bplist_trailer_t)));
+    trailer = (bplist_trailer_t*)end_data;
 
     offset_size = trailer->offset_size;
     ref_size = trailer->ref_size;
@@ -712,10 +717,10 @@
     if (root_object >= num_objects)
         return;
 
-    if (offset_table < plist_bin || offset_table >= plist_bin + length)
+    if (offset_table < start_data || offset_table >= end_data)
         return;
 
-    if (offset_table + num_objects * offset_size >= plist_bin + length)
+    if (offset_table + num_objects * offset_size > end_data)
         return;
 
     struct bplist_data bplist;