commit e9895752a396c4acb8c2b4ba525c13329d4e9fab
author Nikias Bassen <nikias@gmx.li> Wed Feb 01 18:50:00 2017 +0100
committer Nikias Bassen <nikias@gmx.li> Wed Feb 01 18:50:00 2017 +0100
tree f64ce60a28630090708384d68f95a9d9d3be915d
parent cf9836196cbabd6d40e8c1c8018417ef31df5f46

bplist: Avoid heap buffer allocation when parsing array/dict/string/data node sizes > 14

The sizes where effectively parsed by calling parse_uint_node() which
allocates a node_t (along with plist_data_t) that is immediately freed
after retrieving the integer value it holds.
This commit changes the code to directly operate on the binary stream
to 'just' read the size instead, reducing the memory footprint further.

src/bplist.c

diff --git a/src/bplist.c b/src/bplist.c
index 64c9081..2e32f70 100644
--- a/src/bplist.c
+++ b/src/bplist.c
@@ -557,11 +557,12 @@
 
     case BPLIST_DATA:
         if (BPLIST_FILL == size) {
-            plist_t size_node = parse_bin_node(bplist, object);
-            if (plist_get_node_type(size_node) != PLIST_UINT)
+            uint8_t next_size = **object & BPLIST_FILL;
+            if ((**object & BPLIST_MASK) != BPLIST_UINT)
                 return NULL;
-            plist_get_uint_val(size_node, &size);
-            plist_free(size_node);
+            (*object)++;
+            size = UINT_TO_HOST(*object, (1 << next_size));
+            (*object) += (1 << next_size);
         }
 
         if (*object - bplist->data + size >= bplist->size)
@@ -570,11 +571,12 @@
 
     case BPLIST_STRING:
         if (BPLIST_FILL == size) {
-            plist_t size_node = parse_bin_node(bplist, object);
-            if (plist_get_node_type(size_node) != PLIST_UINT)
+            uint8_t next_size = **object & BPLIST_FILL;
+            if ((**object & BPLIST_MASK) != BPLIST_UINT)
                 return NULL;
-            plist_get_uint_val(size_node, &size);
-            plist_free(size_node);
+            (*object)++;
+            size = UINT_TO_HOST(*object, (1 << next_size));
+            (*object) += (1 << next_size);
         }
 
         if (*object - bplist->data + size >= bplist->size)
@@ -583,11 +585,12 @@
 
     case BPLIST_UNICODE:
         if (BPLIST_FILL == size) {
-            plist_t size_node = parse_bin_node(bplist, object);
-            if (plist_get_node_type(size_node) != PLIST_UINT)
+            uint8_t next_size = **object & BPLIST_FILL;
+            if ((**object & BPLIST_MASK) != BPLIST_UINT)
                 return NULL;
-            plist_get_uint_val(size_node, &size);
-            plist_free(size_node);
+            (*object)++;
+            size = UINT_TO_HOST(*object, (1 << next_size));
+            (*object) += (1 << next_size);
         }
 
         if (*object - bplist->data + size * 2 >= bplist->size)
@@ -597,11 +600,12 @@
     case BPLIST_SET:
     case BPLIST_ARRAY:
         if (BPLIST_FILL == size) {
-            plist_t size_node = parse_bin_node(bplist, object);
-            if (plist_get_node_type(size_node) != PLIST_UINT)
+            uint8_t next_size = **object & BPLIST_FILL;
+            if ((**object & BPLIST_MASK) != BPLIST_UINT)
                 return NULL;
-            plist_get_uint_val(size_node, &size);
-            plist_free(size_node);
+            (*object)++;
+            size = UINT_TO_HOST(*object, (1 << next_size));
+            (*object) += (1 << next_size);
         }
 
         if (*object - bplist->data + size >= bplist->size)
@@ -613,11 +617,12 @@
 
     case BPLIST_DICT:
         if (BPLIST_FILL == size) {
-            plist_t size_node = parse_bin_node(bplist, object);
-            if (plist_get_node_type(size_node) != PLIST_UINT)
+	    uint8_t next_size = **object & BPLIST_FILL;
+            if ((**object & BPLIST_MASK) != BPLIST_UINT)
                 return NULL;
-            plist_get_uint_val(size_node, &size);
-            plist_free(size_node);
+            (*object)++;
+            size = UINT_TO_HOST(*object, (1 << next_size));
+            (*object) += (1 << next_size);
         }
 
         if (*object - bplist->data + size >= bplist->size)