ObjFW  Check-in [f28731c106]

Overview
Comment:OFData+MessagePackValue: More precise exceptions
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA3-256: f28731c106f27efab68f5742a176eccc5e4eeea975b559b084e29ef6e36fc510
User & Date: js on 2018-10-13 13:43:01
Other Links: manifest | tags
Context
2018-10-13
21:39
Add -[OFData subdataWithRange:] check-in: 4075c3beaf user: js tags: trunk
13:43
OFData+MessagePackValue: More precise exceptions check-in: f28731c106 user: js tags: trunk
2018-10-07
21:06
OFTCPSocket: Use OF_KINDOF for block types check-in: 53172692a6 user: js tags: trunk
Changes

Modified src/OFData+MessagePackValue.m from [dd53d00818] to [0ca3c45556].

24
25
26
27
28
29
30

31


32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
#import "OFDate.h"
#import "OFDictionary.h"
#import "OFMessagePackExtension.h"
#import "OFNull.h"
#import "OFNumber.h"
#import "OFString.h"


#import "OFInvalidFormatException.h"



int _OFData_MessagePackValue_reference;

static size_t parseObject(const uint8_t *buffer, size_t length, id *object,
    size_t depthLimit);

static uint16_t
readUInt16(const uint8_t *buffer)
{
	return ((uint16_t)buffer[0] << 8) | buffer[1];
}

static uint32_t
readUInt32(const uint8_t *buffer)
{
	return ((uint32_t)buffer[0] << 24) | ((uint32_t)buffer[1] << 16) |
	    ((uint32_t)buffer[2] << 8) | buffer[3];
}

static uint64_t
readUInt64(const uint8_t *buffer)
{
	return ((uint64_t)buffer[0] << 56) | ((uint64_t)buffer[1] << 48) |
	    ((uint64_t)buffer[2] << 40) | ((uint64_t)buffer[3] << 32) |
	    ((uint64_t)buffer[4] << 24) | ((uint64_t)buffer[5] << 16) |
	    ((uint64_t)buffer[6] << 8) | buffer[7];
}

static size_t
parseArray(const uint8_t *buffer, size_t length, id *object, size_t count,
    size_t depthLimit)
{
	void *pool;
	size_t pos = 0;

	if (--depthLimit == 0) {
		*object = nil;
		return 0;
	}

	/*
	 * Don't use capacity! For data and strings, this is safe, as we can
	 * check if we still have enough bytes left. For an array however, we
	 * can't know this, as every child can be more than one byte.
	 */
	*object = [OFMutableArray array];

	for (size_t i = 0; i < count; i++) {
		id child;
		size_t childLength;

		pool = objc_autoreleasePoolPush();

		childLength = parseObject(buffer + pos, length - pos, &child,
		    depthLimit);
		if (childLength == 0 || child == nil) {
			objc_autoreleasePoolPop(pool);

			*object = nil;
			return 0;
		}
		pos += childLength;

		[*object addObject: child];

		objc_autoreleasePoolPop(pool);
	}

	return pos;
}

static size_t
parseTable(const uint8_t *buffer, size_t length, id *object, size_t count,
    size_t depthLimit)
{
	void *pool;
	size_t pos = 0;

	if (--depthLimit == 0) {
		*object = nil;
		return 0;
	}

	/*
	 * Don't use capacity! For data and strings, this is safe, as we can
	 * check if we still have enough bytes left. For a dictionary however,
	 * we can't know this, as every key / value can be more than one byte.
	 */
	*object = [OFMutableDictionary dictionary];

	for (size_t i = 0; i < count; i++) {
		id key, value;
		size_t keyLength, valueLength;

		pool = objc_autoreleasePoolPush();

		keyLength = parseObject(buffer + pos, length - pos, &key,
		    depthLimit);
		if (keyLength == 0 || key == nil) {
			objc_autoreleasePoolPop(pool);

			*object = nil;
			return 0;
		}
		pos += keyLength;

		valueLength = parseObject(buffer + pos, length - pos, &value,
		    depthLimit);
		if (valueLength == 0 || value == nil) {
			objc_autoreleasePoolPop(pool);

			*object = nil;
			return 0;
		}
		pos += valueLength;

		[*object setObject: value
			    forKey: key];

		objc_autoreleasePoolPop(pool);
	}








>

>
>



|
|


|





|






|








|





|
|
<
<










<



|

<
<
<
<
<
<
<










|





|
|
<
<










<



|

<
<
<
<
<
<
<
<
|

<
<
<
<
<
<
<







24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71


72
73
74
75
76
77
78
79
80
81

82
83
84
85
86







87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104


105
106
107
108
109
110
111
112
113
114

115
116
117
118
119








120
121







122
123
124
125
126
127
128
#import "OFDate.h"
#import "OFDictionary.h"
#import "OFMessagePackExtension.h"
#import "OFNull.h"
#import "OFNumber.h"
#import "OFString.h"

#import "OFInvalidArgumentException.h"
#import "OFInvalidFormatException.h"
#import "OFOutOfRangeException.h"
#import "OFTruncatedDataException.h"

int _OFData_MessagePackValue_reference;

static size_t parseObject(const unsigned char *buffer, size_t length,
    id *object, size_t depthLimit);

static uint16_t
readUInt16(const unsigned char *buffer)
{
	return ((uint16_t)buffer[0] << 8) | buffer[1];
}

static uint32_t
readUInt32(const unsigned char *buffer)
{
	return ((uint32_t)buffer[0] << 24) | ((uint32_t)buffer[1] << 16) |
	    ((uint32_t)buffer[2] << 8) | buffer[3];
}

static uint64_t
readUInt64(const unsigned char *buffer)
{
	return ((uint64_t)buffer[0] << 56) | ((uint64_t)buffer[1] << 48) |
	    ((uint64_t)buffer[2] << 40) | ((uint64_t)buffer[3] << 32) |
	    ((uint64_t)buffer[4] << 24) | ((uint64_t)buffer[5] << 16) |
	    ((uint64_t)buffer[6] << 8) | buffer[7];
}

static size_t
parseArray(const unsigned char *buffer, size_t length, id *object, size_t count,
    size_t depthLimit)
{
	void *pool;
	size_t pos = 0;

	if (--depthLimit == 0)
		@throw [OFOutOfRangeException exception];



	/*
	 * Don't use capacity! For data and strings, this is safe, as we can
	 * check if we still have enough bytes left. For an array however, we
	 * can't know this, as every child can be more than one byte.
	 */
	*object = [OFMutableArray array];

	for (size_t i = 0; i < count; i++) {
		id child;


		pool = objc_autoreleasePoolPush();

		pos += parseObject(buffer + pos, length - pos, &child,
		    depthLimit);








		[*object addObject: child];

		objc_autoreleasePoolPop(pool);
	}

	return pos;
}

static size_t
parseTable(const unsigned char *buffer, size_t length, id *object, size_t count,
    size_t depthLimit)
{
	void *pool;
	size_t pos = 0;

	if (--depthLimit == 0)
		@throw [OFOutOfRangeException exception];



	/*
	 * Don't use capacity! For data and strings, this is safe, as we can
	 * check if we still have enough bytes left. For a dictionary however,
	 * we can't know this, as every key / value can be more than one byte.
	 */
	*object = [OFMutableDictionary dictionary];

	for (size_t i = 0; i < count; i++) {
		id key, value;


		pool = objc_autoreleasePoolPush();

		pos += parseObject(buffer + pos, length - pos, &key,
		    depthLimit);








		pos += parseObject(buffer + pos, length - pos, &value,
		    depthLimit);








		[*object setObject: value
			    forKey: key];

		objc_autoreleasePoolPop(pool);
	}

203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
	default:
		return [OFMessagePackExtension extensionWithType: type
							    data: data];
	}
}

static size_t
parseObject(const uint8_t *buffer, size_t length, id *object,
    size_t depthLimit)
{
	size_t count;
	OFData *data;

	if (length < 1)
		goto error;

	/* positive fixint */
	if ((buffer[0] & 0x80) == 0) {
		*object = [OFNumber numberWithUInt8: buffer[0] & 0x7F];
		return 1;
	}
	/* negative fixint */
	if ((buffer[0] & 0xE0) == 0xE0) {
		*object = [OFNumber numberWithInt8:
		    ((int8_t)(buffer[0] & 0x1F)) - 32];
		return 1;
	}

	/* fixstr */
	if ((buffer[0] & 0xE0) == 0xA0) {
		count = buffer[0] & 0x1F;

		if (length < count + 1)
			goto error;

		*object = [OFString
		    stringWithUTF8String: (const char *)buffer + 1
				  length: count];
		return count + 1;
	}








|






|


















|







178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
	default:
		return [OFMessagePackExtension extensionWithType: type
							    data: data];
	}
}

static size_t
parseObject(const unsigned char *buffer, size_t length, id *object,
    size_t depthLimit)
{
	size_t count;
	OFData *data;

	if (length < 1)
		@throw [OFTruncatedDataException exception];

	/* positive fixint */
	if ((buffer[0] & 0x80) == 0) {
		*object = [OFNumber numberWithUInt8: buffer[0] & 0x7F];
		return 1;
	}
	/* negative fixint */
	if ((buffer[0] & 0xE0) == 0xE0) {
		*object = [OFNumber numberWithInt8:
		    ((int8_t)(buffer[0] & 0x1F)) - 32];
		return 1;
	}

	/* fixstr */
	if ((buffer[0] & 0xE0) == 0xA0) {
		count = buffer[0] & 0x1F;

		if (length < count + 1)
			@throw [OFTruncatedDataException exception];

		*object = [OFString
		    stringWithUTF8String: (const char *)buffer + 1
				  length: count];
		return count + 1;
	}

252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
		    buffer[0] & 0xF, depthLimit) + 1;

	/* Prefix byte */
	switch (buffer[0]) {
	/* Unsigned integers */
	case 0xCC: /* uint8 */
		if (length < 2)
			goto error;

		*object = [OFNumber numberWithUInt8: buffer[1]];
		return 2;
	case 0xCD: /* uint 16 */
		if (length < 3)
			goto error;

		*object = [OFNumber numberWithUInt16: readUInt16(buffer + 1)];
		return 3;
	case 0xCE: /* uint 32 */
		if (length < 5)
			goto error;

		*object = [OFNumber numberWithUInt32: readUInt32(buffer + 1)];
		return 5;
	case 0xCF: /* uint 64 */
		if (length < 9)
			goto error;

		*object = [OFNumber numberWithUInt64: readUInt64(buffer + 1)];
		return 9;
	/* Signed integers */
	case 0xD0: /* int 8 */
		if (length < 2)
			goto error;

		*object = [OFNumber numberWithInt8: buffer[1]];
		return 2;
	case 0xD1: /* int 16 */
		if (length < 3)
			goto error;

		*object = [OFNumber numberWithInt16: readUInt16(buffer + 1)];
		return 3;
	case 0xD2: /* int 32 */
		if (length < 5)
			goto error;

		*object = [OFNumber numberWithInt32: readUInt32(buffer + 1)];
		return 5;
	case 0xD3: /* int 64 */
		if (length < 9)
			goto error;

		*object = [OFNumber numberWithInt64: readUInt64(buffer + 1)];
		return 9;
	/* Floating point */
	case 0xCA:; /* float 32 */
		union {
			uint8_t u8[4];
			float f;
		} f;

		if (length < 5)
			goto error;

		memcpy(&f.u8, buffer + 1, 4);

		*object = [OFNumber numberWithFloat: OF_BSWAP_FLOAT_IF_LE(f.f)];
		return 5;
	case 0xCB:; /* float 64 */
		union {
			uint8_t u8[8];
			double d;
		} d;

		if (length < 9)
			goto error;

		memcpy(&d.u8, buffer + 1, 8);

		*object = [OFNumber numberWithDouble:
		    OF_BSWAP_DOUBLE_IF_LE(d.d)];
		return 9;
	/* nil */







|





|





|





|






|





|





|





|






|




|







|




|







227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
		    buffer[0] & 0xF, depthLimit) + 1;

	/* Prefix byte */
	switch (buffer[0]) {
	/* Unsigned integers */
	case 0xCC: /* uint8 */
		if (length < 2)
			@throw [OFTruncatedDataException exception];

		*object = [OFNumber numberWithUInt8: buffer[1]];
		return 2;
	case 0xCD: /* uint 16 */
		if (length < 3)
			@throw [OFTruncatedDataException exception];

		*object = [OFNumber numberWithUInt16: readUInt16(buffer + 1)];
		return 3;
	case 0xCE: /* uint 32 */
		if (length < 5)
			@throw [OFTruncatedDataException exception];

		*object = [OFNumber numberWithUInt32: readUInt32(buffer + 1)];
		return 5;
	case 0xCF: /* uint 64 */
		if (length < 9)
			@throw [OFTruncatedDataException exception];

		*object = [OFNumber numberWithUInt64: readUInt64(buffer + 1)];
		return 9;
	/* Signed integers */
	case 0xD0: /* int 8 */
		if (length < 2)
			@throw [OFTruncatedDataException exception];

		*object = [OFNumber numberWithInt8: buffer[1]];
		return 2;
	case 0xD1: /* int 16 */
		if (length < 3)
			@throw [OFTruncatedDataException exception];

		*object = [OFNumber numberWithInt16: readUInt16(buffer + 1)];
		return 3;
	case 0xD2: /* int 32 */
		if (length < 5)
			@throw [OFTruncatedDataException exception];

		*object = [OFNumber numberWithInt32: readUInt32(buffer + 1)];
		return 5;
	case 0xD3: /* int 64 */
		if (length < 9)
			@throw [OFTruncatedDataException exception];

		*object = [OFNumber numberWithInt64: readUInt64(buffer + 1)];
		return 9;
	/* Floating point */
	case 0xCA:; /* float 32 */
		union {
			unsigned char u8[4];
			float f;
		} f;

		if (length < 5)
			@throw [OFTruncatedDataException exception];

		memcpy(&f.u8, buffer + 1, 4);

		*object = [OFNumber numberWithFloat: OF_BSWAP_FLOAT_IF_LE(f.f)];
		return 5;
	case 0xCB:; /* float 64 */
		union {
			unsigned char u8[8];
			double d;
		} d;

		if (length < 9)
			@throw [OFTruncatedDataException exception];

		memcpy(&d.u8, buffer + 1, 8);

		*object = [OFNumber numberWithDouble:
		    OF_BSWAP_DOUBLE_IF_LE(d.d)];
		return 9;
	/* nil */
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571


572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590



591
592
593
594
595
596
597
598
599
600
601
	/* true */
	case 0xC3:
		*object = [OFNumber numberWithBool: true];
		return 1;
	/* Data */
	case 0xC4: /* bin 8 */
		if (length < 2)
			goto error;

		count = buffer[1];

		if (length < count + 2)
			goto error;

		*object = [OFData dataWithItems: buffer + 2
					  count: count];

		return count + 2;
	case 0xC5: /* bin 16 */
		if (length < 3)
			goto error;

		count = readUInt16(buffer + 1);

		if (length < count + 3)
			goto error;

		*object = [OFData dataWithItems: buffer + 3
					  count: count];

		return count + 3;
	case 0xC6: /* bin 32 */
		if (length < 5)
			goto error;

		count = readUInt32(buffer + 1);

		if (length < count + 5)
			goto error;

		*object = [OFData dataWithItems: buffer + 5
					  count: count];

		return count + 5;
	/* Extensions */
	case 0xC7: /* ext 8 */
		if (length < 3)
			goto error;

		count = buffer[1];

		if (length < count + 3)
			goto error;

		data = [[OFData alloc] initWithItems: buffer + 3
					       count: count];
		@try {
			*object = createExtension(buffer[2], data);
		} @finally {
			[data release];
		}

		return count + 3;
	case 0xC8: /* ext 16 */
		if (length < 4)
			goto error;

		count = readUInt16(buffer + 1);

		if (length < count + 4)
			goto error;

		data = [[OFData alloc] initWithItems: buffer + 4
					       count: count];
		@try {
			*object = createExtension(buffer[3], data);
		} @finally {
			[data release];
		}

		return count + 4;
	case 0xC9: /* ext 32 */
		if (length < 6)
			goto error;

		count = readUInt32(buffer + 1);

		if (length < count + 6)
			goto error;

		data = [[OFData alloc] initWithItems: buffer + 6
					       count: count];
		@try {
			*object = createExtension(buffer[5], data);
		} @finally {
			[data release];
		}

		return count + 6;
	case 0xD4: /* fixext 1 */
		if (length < 3)
			goto error;

		data = [[OFData alloc] initWithItems: buffer + 2
					       count: 1];
		@try {
			*object = createExtension(buffer[1], data);
		} @finally {
			[data release];
		}

		return 3;
	case 0xD5: /* fixext 2 */
		if (length < 4)
			goto error;

		data = [[OFData alloc] initWithItems: buffer + 2
					       count: 2];
		@try {
			*object = createExtension(buffer[1], data);
		} @finally {
			[data release];
		}

		return 4;
	case 0xD6: /* fixext 4 */
		if (length < 6)
			goto error;

		data = [[OFData alloc] initWithItems: buffer + 2
					       count: 4];
		@try {
			*object = createExtension(buffer[1], data);
		} @finally {
			[data release];
		}

		return 6;
	case 0xD7: /* fixext 8 */
		if (length < 10)
			goto error;

		data = [[OFData alloc] initWithItems: buffer + 2
					       count: 8];
		@try {
			*object = createExtension(buffer[1], data);
		} @finally {
			[data release];
		}

		return 10;
	case 0xD8: /* fixext 16 */
		if (length < 18)
			goto error;

		data = [[OFData alloc] initWithItems: buffer + 2
					       count: 16];
		@try {
			*object = createExtension(buffer[1], data);
		} @finally {
			[data release];
		}

		return 18;
	/* Strings */
	case 0xD9: /* str 8 */
		if (length < 2)
			goto error;

		count = buffer[1];

		if (length < count + 2)
			goto error;

		*object = [OFString
		    stringWithUTF8String: (const char *)buffer + 2
				  length: count];
		return count + 2;
	case 0xDA: /* str 16 */
		if (length < 3)
			goto error;

		count = readUInt16(buffer + 1);

		if (length < count + 3)
			goto error;

		*object = [OFString
		    stringWithUTF8String: (const char *)buffer + 3
				  length: count];
		return count + 3;
	case 0xDB: /* str 32 */
		if (length < 5)
			goto error;

		count = readUInt32(buffer + 1);

		if (length < count + 5)
			goto error;

		*object = [OFString
		    stringWithUTF8String: (const char *)buffer + 5
				  length: count];
		return count + 5;
	/* Arrays */
	case 0xDC: /* array 16 */
		if (length < 3)
			goto error;

		return parseArray(buffer + 3, length - 3, object,
		    readUInt16(buffer + 1), depthLimit) + 3;
	case 0xDD: /* array 32 */
		if (length < 5)
			goto error;

		return parseArray(buffer + 5, length - 5, object,
		    readUInt32(buffer + 1), depthLimit) + 5;
	/* Maps */
	case 0xDE: /* map 16 */
		if (length < 3)
			goto error;

		return parseTable(buffer + 3, length - 3, object,
		    readUInt16(buffer + 1), depthLimit) + 3;
	case 0xDF: /* map 32 */
		if (length < 5)
			goto error;

		return parseTable(buffer + 5, length - 5, object,
		    readUInt32(buffer + 1), depthLimit) + 5;


	}

error:
	*object = nil;
	return 0;
}

@implementation OFData (MessagePackValue)
- (id)messagePackValue
{
	return [self messagePackValueWithDepthLimit: 32];
}

- (id)messagePackValueWithDepthLimit: (size_t)depthLimit
{
	void *pool = objc_autoreleasePoolPush();
	size_t count = [self count];
	id object;




	if (parseObject([self items], count, &object, depthLimit) != count ||
	    object == nil)
		@throw [OFInvalidFormatException exception];

	[object retain];

	objc_autoreleasePoolPop(pool);

	return object;
}
@end







|




|







|




|







|




|








|




|












|




|












|




|












|












|












|












|












|













|




|







|




|







|




|








|





|






|





|



>
>

<
<
<
<














>
>
>
|
<









317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549




550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567

568
569
570
571
572
573
574
575
576
	/* true */
	case 0xC3:
		*object = [OFNumber numberWithBool: true];
		return 1;
	/* Data */
	case 0xC4: /* bin 8 */
		if (length < 2)
			@throw [OFTruncatedDataException exception];

		count = buffer[1];

		if (length < count + 2)
			@throw [OFTruncatedDataException exception];

		*object = [OFData dataWithItems: buffer + 2
					  count: count];

		return count + 2;
	case 0xC5: /* bin 16 */
		if (length < 3)
			@throw [OFTruncatedDataException exception];

		count = readUInt16(buffer + 1);

		if (length < count + 3)
			@throw [OFTruncatedDataException exception];

		*object = [OFData dataWithItems: buffer + 3
					  count: count];

		return count + 3;
	case 0xC6: /* bin 32 */
		if (length < 5)
			@throw [OFTruncatedDataException exception];

		count = readUInt32(buffer + 1);

		if (length < count + 5)
			@throw [OFTruncatedDataException exception];

		*object = [OFData dataWithItems: buffer + 5
					  count: count];

		return count + 5;
	/* Extensions */
	case 0xC7: /* ext 8 */
		if (length < 3)
			@throw [OFTruncatedDataException exception];

		count = buffer[1];

		if (length < count + 3)
			@throw [OFTruncatedDataException exception];

		data = [[OFData alloc] initWithItems: buffer + 3
					       count: count];
		@try {
			*object = createExtension(buffer[2], data);
		} @finally {
			[data release];
		}

		return count + 3;
	case 0xC8: /* ext 16 */
		if (length < 4)
			@throw [OFTruncatedDataException exception];

		count = readUInt16(buffer + 1);

		if (length < count + 4)
			@throw [OFTruncatedDataException exception];

		data = [[OFData alloc] initWithItems: buffer + 4
					       count: count];
		@try {
			*object = createExtension(buffer[3], data);
		} @finally {
			[data release];
		}

		return count + 4;
	case 0xC9: /* ext 32 */
		if (length < 6)
			@throw [OFTruncatedDataException exception];

		count = readUInt32(buffer + 1);

		if (length < count + 6)
			@throw [OFTruncatedDataException exception];

		data = [[OFData alloc] initWithItems: buffer + 6
					       count: count];
		@try {
			*object = createExtension(buffer[5], data);
		} @finally {
			[data release];
		}

		return count + 6;
	case 0xD4: /* fixext 1 */
		if (length < 3)
			@throw [OFTruncatedDataException exception];

		data = [[OFData alloc] initWithItems: buffer + 2
					       count: 1];
		@try {
			*object = createExtension(buffer[1], data);
		} @finally {
			[data release];
		}

		return 3;
	case 0xD5: /* fixext 2 */
		if (length < 4)
			@throw [OFTruncatedDataException exception];

		data = [[OFData alloc] initWithItems: buffer + 2
					       count: 2];
		@try {
			*object = createExtension(buffer[1], data);
		} @finally {
			[data release];
		}

		return 4;
	case 0xD6: /* fixext 4 */
		if (length < 6)
			@throw [OFTruncatedDataException exception];

		data = [[OFData alloc] initWithItems: buffer + 2
					       count: 4];
		@try {
			*object = createExtension(buffer[1], data);
		} @finally {
			[data release];
		}

		return 6;
	case 0xD7: /* fixext 8 */
		if (length < 10)
			@throw [OFTruncatedDataException exception];

		data = [[OFData alloc] initWithItems: buffer + 2
					       count: 8];
		@try {
			*object = createExtension(buffer[1], data);
		} @finally {
			[data release];
		}

		return 10;
	case 0xD8: /* fixext 16 */
		if (length < 18)
			@throw [OFTruncatedDataException exception];

		data = [[OFData alloc] initWithItems: buffer + 2
					       count: 16];
		@try {
			*object = createExtension(buffer[1], data);
		} @finally {
			[data release];
		}

		return 18;
	/* Strings */
	case 0xD9: /* str 8 */
		if (length < 2)
			@throw [OFTruncatedDataException exception];

		count = buffer[1];

		if (length < count + 2)
			@throw [OFTruncatedDataException exception];

		*object = [OFString
		    stringWithUTF8String: (const char *)buffer + 2
				  length: count];
		return count + 2;
	case 0xDA: /* str 16 */
		if (length < 3)
			@throw [OFTruncatedDataException exception];

		count = readUInt16(buffer + 1);

		if (length < count + 3)
			@throw [OFTruncatedDataException exception];

		*object = [OFString
		    stringWithUTF8String: (const char *)buffer + 3
				  length: count];
		return count + 3;
	case 0xDB: /* str 32 */
		if (length < 5)
			@throw [OFTruncatedDataException exception];

		count = readUInt32(buffer + 1);

		if (length < count + 5)
			@throw [OFTruncatedDataException exception];

		*object = [OFString
		    stringWithUTF8String: (const char *)buffer + 5
				  length: count];
		return count + 5;
	/* Arrays */
	case 0xDC: /* array 16 */
		if (length < 3)
			@throw [OFTruncatedDataException exception];

		return parseArray(buffer + 3, length - 3, object,
		    readUInt16(buffer + 1), depthLimit) + 3;
	case 0xDD: /* array 32 */
		if (length < 5)
			@throw [OFTruncatedDataException exception];

		return parseArray(buffer + 5, length - 5, object,
		    readUInt32(buffer + 1), depthLimit) + 5;
	/* Maps */
	case 0xDE: /* map 16 */
		if (length < 3)
			@throw [OFTruncatedDataException exception];

		return parseTable(buffer + 3, length - 3, object,
		    readUInt16(buffer + 1), depthLimit) + 3;
	case 0xDF: /* map 32 */
		if (length < 5)
			@throw [OFTruncatedDataException exception];

		return parseTable(buffer + 5, length - 5, object,
		    readUInt32(buffer + 1), depthLimit) + 5;
	default:
		@throw [OFInvalidFormatException exception];
	}




}

@implementation OFData (MessagePackValue)
- (id)messagePackValue
{
	return [self messagePackValueWithDepthLimit: 32];
}

- (id)messagePackValueWithDepthLimit: (size_t)depthLimit
{
	void *pool = objc_autoreleasePoolPush();
	size_t count = [self count];
	id object;

	if ([self itemSize] != 1)
		@throw [OFInvalidArgumentException exception];

	if (parseObject([self items], count, &object, depthLimit) != count)

		@throw [OFInvalidFormatException exception];

	[object retain];

	objc_autoreleasePoolPop(pool);

	return object;
}
@end

Modified src/OFXMLParser.m from [a92d1baa88] to [543440cf05].

395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
	case '!':
		_last = _i + 1;
		_state = OF_XMLPARSER_IN_EXCLAMATIONMARK;
		_acceptProlog = false;
		break;
	default:
		if (_depthLimit > 0 && [_previous count] >= _depthLimit)
			@throw [OFMalformedXMLException
			    exceptionWithParser: self];

		_state = OF_XMLPARSER_IN_TAG_NAME;
		_acceptProlog = false;
		_i--;
		break;
	}
}







|
<







395
396
397
398
399
400
401
402

403
404
405
406
407
408
409
	case '!':
		_last = _i + 1;
		_state = OF_XMLPARSER_IN_EXCLAMATIONMARK;
		_acceptProlog = false;
		break;
	default:
		if (_depthLimit > 0 && [_previous count] >= _depthLimit)
			@throw [OFOutOfRangeException exception];


		_state = OF_XMLPARSER_IN_TAG_NAME;
		_acceptProlog = false;
		_i--;
		break;
	}
}