[xar] Memory bug
[xar] Memory bug
- Subject: [xar] Memory bug
- From: Stephane Sudre <email@hidden>
- Date: Sun, 11 Feb 2018 01:10:35 +0100
Just for info.
There's a bug in the xar_from_base64 function of the b64.c file of the
xar project (which is used in pkgutil and probably in
PackageKit.framework).
The output of the function can be incorrect because the output array
of unsigned chars is is not set to 0.
This is the bug:
output = malloc(3 * (inputLength / 4 + 1));
So in case output is allocated to some location that was previously
used, the contents of output will not be a bunch of zeroes (so no
terminating NULL char after the last decoded character). And anyway,
it should not be assumed to be a bunch of zeroes.
It just happens that having a distribution package (.pkg) containing a
Package name with some accented characters (such as é) will trigger
the bug every single time when using pkgutil --expand or xar -tc
This problem can be reproduced on Mac OS X 10.10.5 and 10.11.6 with
the Apple built binaries and it can be reproduced using the latest xar
source code available on opensource.apple.com (xar-400). And based on
what I see in xar-28, the problem is apparently there since Mac OS X
10.5.0.
Problem# 37427477
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-dev mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden