bugGNUstep - Bugs: bug #40620, Deserialising property lists in...

Group
 
 

bug #40620: Deserialising property lists in arguments can lead to an infinite loop

Submitter:  Niels Grewe <thebeing>
Submitted:  Mon 18 Nov 2013 09:19:08 AM UTC
   
 
Category:  Base/Foundation Severity:  3 - Normal
Item Group:  Bug Status:  Fixed
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Wed 20 Nov 2013 06:14:23 AM UTC, comment #1: 

Thanks … I added a fix for that … simply preventing recursion in the method parsing the arguments, and using existing/default values for GSPrivateDefaultsFlag() during that time too.

Richard Frith-Macdonald <CaS>
Group Member
Mon 18 Nov 2013 09:19:08 AM UTC, original submission:  

At some places, property list deserialisation queries some information about the format using the GSPrivateDefaultsFlag() function. That function depends on the user defaults being properly initialised.

 It turns out that this is a bit unsafe is we are deserialising the plist as part of initialisation of the defaults system. You can easily reproduce this if you add a `-Foo "{ Foo = Bar }"' (note how the semicolon is missing after`Bar') to the invocation of any GNUstep app or tool. The plist parser then queries the GSMacOSXCompatible flag to find to whether it should just warn about the error or reject the plist. There are a couple of other places where we are using the function, so I think we should review them and change the code to adopt a sensible default when the user defaults are not yet set up.

Niels Grewe <thebeing>
Group Member

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

Carbon-Copy List
  • -email is unavailable- added by CaS (Posted a comment)
  • -email is unavailable- added by thebeing (Submitted the item)
  •  

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.

     

    Follow 2 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2013-11-20 CaS StatusNone Fixed
        Open/ClosedOpen Closed

    Back to the top

    Powered by Savane 3.13-d3ae.
    Corresponding source code