bugGNUstep - Bugs: bug #40620, Deserialising property lists in...

 
 

You are not allowed to post comments on this tracker with your current authentification level.

bug #40620: Deserialising property lists in arguments can lead to an infinite loop

Submitted by:  Niels Grewe <thebeing>
Submitted on:  Mon 18 Nov 2013 09:19:08 AM UTC  
 
Category: Base/FoundationSeverity: 3 - Normal
Item Group: BugStatus: Fixed
Privacy: PublicAssigned to: None
Open/Closed: Closed

Wed 20 Nov 2013 06:14:23 AM UTC, comment #1:

Thanks … I added a fix for that … simply preventing recursion in the method parsing the arguments, and using existing/default values for GSPrivateDefaultsFlag() during that time too.

Richard Frith-Macdonald <CaS>
Project Member
Mon 18 Nov 2013 09:19:08 AM UTC, original submission:

At some places, property list deserialisation queries some information about the format using the GSPrivateDefaultsFlag() function. That function depends on the user defaults being properly initialised.

It turns out that this is a bit unsafe is we are deserialising the plist as part of initialisation of the defaults system. You can easily reproduce this if you add a `-Foo "{ Foo = Bar }"' (note how the semicolon is missing after`Bar') to the invocation of any GNUstep app or tool. The plist parser then queries the GSMacOSXCompatible flag to find to whether it should just warn about the error or reject the plist. There are a couple of other places where we are using the function, so I think we should review them and change the code to adopt a sensible default when the user defaults are not yet set up.

Niels Grewe <thebeing>
Project Member

 

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -unavailable- added by CaS (Posted a comment)
  • -unavailable- added by thebeing (Submitted the item)
  •  

    Do you think this task is very important?
    If so, you can click here to add your encouragement to it.
    This task has 0 encouragements so far.

    Only logged-in users can vote.

     

    Please enter the title of George Orwell's famous dystopian book (it's a date):

     

     

    Follow 2 latest changes.

    Date Changed By Updated Field Previous Value => Replaced By
    Wed 20 Nov 2013 06:14:23 AM UTCCaSStatusNone=>Fixed
      Open/ClosedOpen=>Closed

    Back to the top


    Powered by Savane 3.1-cleanup