macosx-10.9.5/CF-855.17/CFBinaryPList.c

271 	list of ints, byte size of which is given in trailer
273 	-- number of these is in the trailer
614     CFBinaryPlistTrailer trailer;
654     memset(&trailer, 0, sizeof(trailer));
655     trailer._numObjects = CFSwapInt64HostToBig(cnt);
656     trailer._topObject = 0;	// true for this implementation
657     trailer._objectRefSize = _byteCount(cnt);
661 	Boolean success = _appendObject(buf, obj, objtable, trailer._objectRefSize);
681     trailer._offsetTableOffset = CFSwapInt64HostToBig(length_so_far);
682     trailer._offsetIntSize = _byteCount(length_so_far);
687 	bufferWrite(buf, source + sizeof(*offsets) - trailer._offsetIntSize, trailer._offsetIntSize);
689     length_so_far += cnt * trailer._offsetIntSize;
692     bufferWrite(buf, (uint8_t *)&trailer, sizeof(trailer));
694     length_so_far += sizeof(trailer);
731 CF_PRIVATE bool __CFBinaryPlistCreateObjectFiltered(const uint8_t *databytes, uint64_t datalen, uint64_t startOffset, const CFBinaryPlistTrailer *trailer, CFAllocatorRef allocator, CFOptionFlags mutabilityOption, CFMutableDictionaryRef objects, CFMutableSetRef set, CFIndex curDepth, CFSetRef keyPaths, CFPropertyListRef *plist);
759 bool __CFBinaryPlistGetTopLevelInfo(const uint8_t *databytes, uint64_t datalen, uint8_t *marker, uint64_t *offset, CFBinaryPlistTrailer *trailer) {
772     // In Leopard, the unused bytes in the trailer must be 0 or the parse will fail
791     // The trailer must point to a value before itself in the data.
815     // The total size of the data should be equal to the sum of offsetTableOffset + sizeof(trailer)
843     if (trailer) *trailer = trail;
872 CF_INLINE uint64_t _getOffsetOfRefAt(const uint8_t *databytes, const uint8_t *bytesptr, const CFBinaryPlistTrailer *trailer) {
873     // *trailer contents are trusted, even for overflows -- was checked when the trailer was parsed;
877     const uint8_t *offsetsFirstByte = databytes + trailer->_offsetTableOffset;
878     if (bytesptr < objectsFirstByte || offsetsFirstByte - trailer->_objectRefSize < bytesptr) FAIL_MAXOFFSET;
880     uint64_t ref = _getSizedInt(bytesptr, trailer->_objectRefSize);
881     if (trailer->_numObjects <= ref) FAIL_MAXOFFSET;
883     bytesptr = databytes + trailer->_offsetTableOffset + ref * trailer->_offsetIntSize;
884     uint64_t off = _getSizedInt(bytesptr, trailer->_offsetIntSize);
888 bool __CFBinaryPlistGetOffsetForValueFromArray2(const uint8_t *databytes, uint64_t datalen, uint64_t startOffset, const CFBinaryPlistTrailer *trailer, CFIndex idx, uint64_t *offset, CFMutableDictionaryRef objects) {
889     uint64_t objectsRangeStart = 8, objectsRangeEnd = trailer->_offsetTableOffset - 1;
905     size_t byte_cnt = check_size_t_mul(cnt, trailer->_objectRefSize, &err);
910     uint64_t off = _getOffsetOfRefAt(databytes, ptr + idx * trailer->_objectRefSize, trailer);
919  @param trailer A pointer to a filled out trailer structure (use __CFBinaryPlistGetTopLevelInfo).
927 bool __CFBinaryPlistGetOffsetForValueFromDictionary3(const uint8_t *databytes, uint64_t datalen, uint64_t startOffset, const CFBinaryPlistTrailer *trailer, CFTypeRef key, uint64_t *koffset, uint64_t *voffset, Boolean unused, CFMutableDictionaryRef objects) {
933     uint64_t objectsRangeStart = 8, objectsRangeEnd = trailer->_offsetTableOffset - 1;
958     size_t byte_cnt = check_size_t_mul(cnt, trailer->_objectRefSize, &err);
977     uint64_t totalKeySize = cnt * trailer->_objectRefSize;
999 	off = _getOffsetOfRefAt(databytes, ptr, trailer);
1023 		if (databytes + trailer->_offsetTableOffset <= extent) FAIL_FALSE;
1035 	    if (!__CFBinaryPlistCreateObjectFiltered(databytes, datalen, off, trailer, kCFAllocatorSystemDefault, kCFPropertyListImmutable, NULL /*objects*/, NULL, 0, NULL, &keyInData) || !_plistIsPrimitive(keyInData)) {
1046 	    if (voffset) *voffset = _getOffsetOfRefAt(databytes, ptr + totalKeySize, trailer);
1050 	ptr += trailer->_objectRefSize;
1061 CF_PRIVATE bool __CFBinaryPlistCreateObjectFiltered(const uint8_t *databytes, uint64_t datalen, uint64_t startOffset, const CFBinaryPlistTrailer *trailer, CFAllocatorRef allocator, CFOptionFlags mutabilityOption, CFMutableDictionaryRef objects, CFMutableSetRef set, CFIndex curDepth, CFSetRef keyPaths, CFPropertyListRef *plist) {
1076     // *trailer contents are trusted, even for overflows -- was checked when the trailer was parsed
1077     uint64_t objectsRangeStart = 8, objectsRangeEnd = trailer->_offsetTableOffset - 1;
1312 	size_t byte_cnt = check_size_t_mul(arrayCount, trailer->_objectRefSize, &err);
1345                         Boolean found = __CFBinaryPlistGetOffsetForValueFromArray2(databytes, datalen, startOffset, trailer, (CFIndex)intValue, &valueOffset, objects);
1348                             success = __CFBinaryPlistCreateObjectFiltered(databytes, datalen, valueOffset, trailer, allocator, mutabilityOption, objects, set, curDepth + 1, nextKeys, &result);
1378                 off = _getOffsetOfRefAt(databytes, ptr, trailer);
1379                 if (!__CFBinaryPlistCreateObjectFiltered(databytes, datalen, off, trailer, allocator, mutabilityOption, objects, set, curDepth + 1, NULL, &pl)) {
1387                 ptr += trailer->_objectRefSize;
1452 	size_t byte_cnt = check_size_t_mul(dictionaryCount, trailer->_objectRefSize, &err);
1481                     Boolean found = __CFBinaryPlistGetOffsetForValueFromDictionary3(databytes, datalen, startOffset, trailer, key, &keyOffset, &valueOffset, false, objects);
1484                         success = __CFBinaryPlistCreateObjectFiltered(databytes, datalen, valueOffset, trailer, allocator, mutabilityOption, objects, set, curDepth + 1, nextKeys, &result);
1513                 off = _getOffsetOfRefAt(databytes, ptr, trailer);
1514                 if (!__CFBinaryPlistCreateObjectFiltered(databytes, datalen, off, trailer, allocator, mutabilityOption, objects, set, curDepth + 1, NULL, &pl) || (idx < dictionaryCount / 2 && !_plistIsPrimitive(pl))) {
1523                 ptr += trailer->_objectRefSize;
1559 bool __CFBinaryPlistCreateObject(const uint8_t *databytes, uint64_t datalen, uint64_t startOffset, const CFBinaryPlistTrailer *trailer, CFAllocatorRef allocator, CFOptionFlags mutabilityOption, CFMutableDictionaryRef objects, CFPropertyListRef *plist) {
1561     return __CFBinaryPlistCreateObjectFiltered(databytes, datalen, startOffset, trailer, allocator, mutabilityOption, objects, NULL, 0, NULL, plist);
1566     CFBinaryPlistTrailer trailer;
1571     if (8 <= datalen && __CFBinaryPlistGetTopLevelInfo(databytes, datalen, &marker, &offset, &trailer)) {
1579 	_CFDictionarySetCapacity(objects, trailer._numObjects);
1582         if (__CFBinaryPlistCreateObjectFiltered(databytes, datalen, offset, &trailer, allocator, option, objects, NULL, 0, NULL, &pl)) {