[launchd-changes] [22981] trunk/launchd/src/launchd_core_logic.c

[source_changes at macosforge.org]

Revision: 22981
          http://trac.macosforge.org/projects/launchd/changeset/22981
Author:   zarzycki at apple.com
Date:     2006-12-14 11:18:26 -0800 (Thu, 14 Dec 2006)

Log Message:
-----------
<rdar://problem/4881530> launchd crashes when parsing malformed plist

Modified Paths:
--------------
    trunk/launchd/src/launchd_core_logic.c

Modified: trunk/launchd/src/launchd_core_logic.c
===================================================================
--- trunk/launchd/src/launchd_core_logic.c	2006-12-14 18:08:28 UTC (rev 22980)
+++ trunk/launchd/src/launchd_core_logic.c	2006-12-14 19:18:26 UTC (rev 22981)
@@ -1377,24 +1377,52 @@
 	if (pload == NULL) {
 		return NULL;
 	}
+
 	if (launch_data_get_type(pload) != LAUNCH_DATA_DICTIONARY) {
+		errno = EINVAL;
 		return NULL;
 	}
 
 	if ((tmp = launch_data_dict_lookup(pload, LAUNCH_JOBKEY_LABEL)) &&
 			(launch_data_get_type(tmp) == LAUNCH_DATA_STRING)) {
-		label = launch_data_get_string(tmp);
+		if (!(label = launch_data_get_string(tmp))) {
+			errno = EINVAL;
+			return NULL;
+		}
 	}
+
 	if ((tmp = launch_data_dict_lookup(pload, LAUNCH_JOBKEY_PROGRAM)) &&
 			(launch_data_get_type(tmp) == LAUNCH_DATA_STRING)) {
 		prog = launch_data_get_string(tmp);
 	}
-	ldpa = launch_data_dict_lookup(pload, LAUNCH_JOBKEY_PROGRAMARGUMENTS);
 
-	if (label == NULL) {
-		errno = EINVAL;
-		return NULL;
-	} else if ((j = jobmgr_find(root_jobmgr, label)) != NULL) {
+	if ((ldpa = launch_data_dict_lookup(pload, LAUNCH_JOBKEY_PROGRAMARGUMENTS))) {
+		size_t i, c;
+
+		if (launch_data_get_type(ldpa) != LAUNCH_DATA_ARRAY) {
+			errno = EINVAL;
+			return NULL;
+		}
+
+		c = launch_data_array_get_count(ldpa);
+
+		argv = alloca((c + 1) * sizeof(char *));
+
+		for (i = 0; i < c; i++) {
+			tmp = launch_data_array_get_index(ldpa, i);
+
+			if (launch_data_get_type(tmp) != LAUNCH_DATA_STRING) {
+				errno = EINVAL;
+				return NULL;
+			}
+
+			argv[i] = launch_data_get_string(tmp);
+		}
+
+		argv[i] = NULL;
+	}
+
+	if ((j = jobmgr_find(root_jobmgr, label)) != NULL) {
 		errno = EEXIST;
 		return NULL;
 	} else if (label[0] == '\0' || (strncasecmp(label, "", strlen("com.apple.launchd")) == 0) ||
@@ -1405,16 +1433,6 @@
 		return NULL;
 	}
 
-	if (ldpa) {
-		size_t i, c = launch_data_array_get_count(ldpa);
-
-		argv = alloca((c + 1) * sizeof(char *));
-
-		for (i = 0; i < c; i++)
-			argv[i] = launch_data_get_string(launch_data_array_get_index(ldpa, i));
-		argv[i] = NULL;
-	}
-
 	if ((j = job_new(root_jobmgr, label, prog, argv, NULL))) {
 		launch_data_dict_iterate(pload, job_import_keys, j);
 	}

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://lists.macosforge.org/pipermail/launchd-changes/attachments/20061214/80635fbf/attachment.html