bugGNUstep - Bugs: bug #40620, Deserialising property lists in...


You are not allowed to post comments on this tracker with your current authentication level.

bug #40620: Deserialising property lists in arguments can lead to an infinite loop

Submitted by:  Niels Grewe <thebeing>
Submitted on:  Mon 18 Nov 2013 09:19:08 AM UTC  
Category:  Base/Foundation Severity:  3 - Normal
Item Group:  Bug Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed

Wed 20 Nov 2013 06:14:23 AM UTC, comment #1:

Thanks … I added a fix for that … simply preventing recursion in the method parsing the arguments, and using existing/default values for GSPrivateDefaultsFlag() during that time too.

Richard Frith-Macdonald <CaS>
Project Member
Mon 18 Nov 2013 09:19:08 AM UTC, original submission:

At some places, property list deserialisation queries some information about the format using the GSPrivateDefaultsFlag() function. That function depends on the user defaults being properly initialised.

It turns out that this is a bit unsafe is we are deserialising the plist as part of initialisation of the defaults system. You can easily reproduce this if you add a `-Foo "{ Foo = Bar }"' (note how the semicolon is missing after`Bar') to the invocation of any GNUstep app or tool. The plist parser then queries the GSMacOSXCompatible flag to find to whether it should just warn about the error or reject the plist. There are a couple of other places where we are using the function, so I think we should review them and change the code to adopt a sensible default when the user defaults are not yet set up.

Niels Grewe <thebeing>
Project Member


No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by CaS (Posted a comment)
  • -email is unavailable- added by thebeing (Submitted the item)

    Do you think this task is very important?
    If so, you can add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.




    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-11-20 CaS StatusNone => Fixed
        Open/ClosedOpen => Closed

    Back to the top

    Powered by Savane 3.3