Limit individual allocation sizes to the size of the plist being read.

1 files changed, 22 insertions, 0 deletions

diff --git a/tests/fuzzer.rs b/tests/fuzzer.rs
new file mode 100644
index 0000000..701df5e
--- /dev/null
+++ b/tests/fuzzer.rs
@@ -0,0 +1,22 @@
+extern crate plist;
+
+use std::io::Cursor;
+use plist::Plist;
+
+#[test]
+fn too_large_allocation() {
+    let data = b"bplist00\"&L^^^^^^^^-^^^^^^^^^^^";
+    test_fuzzer_data_err(data);
+}
+
+#[test]
+fn too_large_allocation_2() {
+    let data = b"bplist00;<)\x9fX\x0a<h\x0a:hhhhG:hh\x0amhhhhhhx#hhT)\x0a*";
+    test_fuzzer_data_err(data);
+}
+
+fn test_fuzzer_data_err(data: &[u8]) {
+    let cursor = Cursor::new(data);
+    let res = Plist::read(cursor);
+    assert!(res.is_err());
+}