commit b1be1e99dd1f489720e83d018bcbdb91fb1e87e5
author Nikias Bassen <nikias@gmx.li> Thu Feb 09 14:50:48 2017 +0100
committer Nikias Bassen <nikias@gmx.li> Thu Feb 09 14:50:48 2017 +0100
tree fcf66358aeb7826b273ca8c52576b6e910c4fa63
parent 47d02dde60b4c709d579aa22187ac55524485b97

bplist: Make sure to detect integer overflow when handling unicode node size

Credit to OSS-Fuzz

src/bplist.c

diff --git a/src/bplist.c b/src/bplist.c
index bf8d985..da7bb63 100644
--- a/src/bplist.c
+++ b/src/bplist.c
@@ -668,6 +668,10 @@
         return parse_string_node(object, size);
 
     case BPLIST_UNICODE:
+        if (size*2 < size) {
+            PLIST_BIN_ERR("%s: Integer overflow when calculating BPLIST_UNICODE data size.\n", __func__);
+            return NULL;
+        }
         if (*object + size*2 > bplist->offset_table) {
             PLIST_BIN_ERR("%s: BPLIST_UNICODE data bytes point outside of valid range\n", __func__);
             return NULL;