Revision: 22981 http://trac.macosforge.org/projects/launchd/changeset/22981 Author: zarzycki@apple.com Date: 2006-12-14 11:18:26 -0800 (Thu, 14 Dec 2006) Log Message: ----------- <rdar://problem/4881530> launchd crashes when parsing malformed plist Modified Paths: -------------- trunk/launchd/src/launchd_core_logic.c Modified: trunk/launchd/src/launchd_core_logic.c =================================================================== --- trunk/launchd/src/launchd_core_logic.c 2006-12-14 18:08:28 UTC (rev 22980) +++ trunk/launchd/src/launchd_core_logic.c 2006-12-14 19:18:26 UTC (rev 22981) @@ -1377,24 +1377,52 @@ if (pload == NULL) { return NULL; } + if (launch_data_get_type(pload) != LAUNCH_DATA_DICTIONARY) { + errno = EINVAL; return NULL; } if ((tmp = launch_data_dict_lookup(pload, LAUNCH_JOBKEY_LABEL)) && (launch_data_get_type(tmp) == LAUNCH_DATA_STRING)) { - label = launch_data_get_string(tmp); + if (!(label = launch_data_get_string(tmp))) { + errno = EINVAL; + return NULL; + } } + if ((tmp = launch_data_dict_lookup(pload, LAUNCH_JOBKEY_PROGRAM)) && (launch_data_get_type(tmp) == LAUNCH_DATA_STRING)) { prog = launch_data_get_string(tmp); } - ldpa = launch_data_dict_lookup(pload, LAUNCH_JOBKEY_PROGRAMARGUMENTS); - if (label == NULL) { - errno = EINVAL; - return NULL; - } else if ((j = jobmgr_find(root_jobmgr, label)) != NULL) { + if ((ldpa = launch_data_dict_lookup(pload, LAUNCH_JOBKEY_PROGRAMARGUMENTS))) { + size_t i, c; + + if (launch_data_get_type(ldpa) != LAUNCH_DATA_ARRAY) { + errno = EINVAL; + return NULL; + } + + c = launch_data_array_get_count(ldpa); + + argv = alloca((c + 1) * sizeof(char *)); + + for (i = 0; i < c; i++) { + tmp = launch_data_array_get_index(ldpa, i); + + if (launch_data_get_type(tmp) != LAUNCH_DATA_STRING) { + errno = EINVAL; + return NULL; + } + + argv[i] = launch_data_get_string(tmp); + } + + argv[i] = NULL; + } + + if ((j = jobmgr_find(root_jobmgr, label)) != NULL) { errno = EEXIST; return NULL; } else if (label[0] == '\0' || (strncasecmp(label, "", strlen("com.apple.launchd")) == 0) || @@ -1405,16 +1433,6 @@ return NULL; } - if (ldpa) { - size_t i, c = launch_data_array_get_count(ldpa); - - argv = alloca((c + 1) * sizeof(char *)); - - for (i = 0; i < c; i++) - argv[i] = launch_data_get_string(launch_data_array_get_index(ldpa, i)); - argv[i] = NULL; - } - if ((j = job_new(root_jobmgr, label, prog, argv, NULL))) { launch_data_dict_iterate(pload, job_import_keys, j); }