NSKeyedUnarchiver SGBigUTF8String Decoding Information Leak
Posted by deepcore on August 13, 2019 – 10:32 pm
NSKeyedUnarchiver suffers from an information leak when decoding the SGBigUTF8String class using [SGBigUTF8String initWithCoder:]. This class initializes the string using [SGBigUTF8String initWithUTF8DataNullTerminated:] even though there is no guarantee the bytes provided to the decoder are null terminated. It should use [SGBigUTF8String initWithUTF8Data:] instead.
Post a reply
You must be logged in to post a comment.