Index: src/OFDataArray+BinaryPackValue.m ================================================================== --- src/OFDataArray+BinaryPackValue.m +++ src/OFDataArray+BinaryPackValue.m @@ -154,28 +154,13 @@ *object = [OFNumber numberWithInt8: ((int8_t)(buffer[0] & 0x1F)) - 32]; return 1; } - /* Data */ - if ((buffer[0] & 0xF0) == 0xA0) { - count = buffer[0] & 0xF; - - if (length < count + 1) - goto error; - - *object = [OFDataArray dataArrayWithItemSize: 1 - capacity: count]; - [*object addItems: buffer + 1 - count: count]; - - return count + 1; - } - /* String */ - if ((buffer[0] & 0xF0) == 0xB0) { - count = buffer[0] & 0xF; + if ((buffer[0] & 0xE0) == 0xA0) { + count = buffer[0] & 0x1F; if (length < count + 1) goto error; *object = [OFString @@ -288,10 +273,25 @@ /* true */ case 0xC3: *object = [OFNumber numberWithBool: YES]; return 1; /* Data */ + case 0xD9: + if (length < 2) + goto error; + + count = buffer[1]; + + if (length < count + 2) + goto error; + + *object = [OFDataArray dataArrayWithItemSize: 1 + capacity: count]; + [*object addItems: buffer + 2 + count: count]; + + return count + 2; case 0xDA: if (length < 3) goto error; count = read_uint16(buffer + 1); @@ -319,11 +319,24 @@ [*object addItems: buffer + 5 count: count]; return count + 5; /* Strings */ - case 0xD8: + case 0xD6: + if (length < 2) + goto error; + + count = buffer[1]; + + if (length < count + 2) + goto error; + + *object = [OFString + stringWithUTF8String: (const char*)buffer + 2 + length: count]; + return count + 2; + case 0xD7: if (length < 3) goto error; count = read_uint16(buffer + 1); @@ -332,11 +345,11 @@ *object = [OFString stringWithUTF8String: (const char*)buffer + 3 length: count]; return count + 3; - case 0xD9: + case 0xD8: if (length < 5) goto error; count = read_uint32(buffer + 1); Index: src/OFDataArray.m ================================================================== --- src/OFDataArray.m +++ src/OFDataArray.m @@ -624,16 +624,18 @@ if (_itemSize != 1) @throw [OFInvalidArgumentException exceptionWithClass: [self class] selector: _cmd]; - if (_count <= 15) { - uint8_t tmp = 0xA0 | ((uint8_t)_count & 0xF); + if (_count <= UINT8_MAX) { + uint8_t type = 0xD9; + uint8_t tmp = (uint8_t)_count; data = [OFDataArray dataArrayWithItemSize: 1 - capacity: _count + 1]; + capacity: _count + 2]; + [data addItem: &type]; [data addItem: &tmp]; } else if (_count <= UINT16_MAX) { uint8_t type = 0xDA; uint16_t tmp = OF_BSWAP16_IF_LE((uint16_t)_count); Index: src/OFString.m ================================================================== --- src/OFString.m +++ src/OFString.m @@ -1594,29 +1594,38 @@ OFDataArray *data; size_t length; length = [self UTF8StringLength]; - if (length <= 15) { - uint8_t tmp = 0xB0 | ((uint8_t)length & 0xF); + if (length <= 31) { + uint8_t tmp = 0xA0 | ((uint8_t)length & 0x1F); data = [OFDataArray dataArrayWithItemSize: 1 capacity: length + 1]; + [data addItem: &tmp]; + } else if (length <= UINT8_MAX) { + uint8_t type = 0xD6; + uint8_t tmp = (uint8_t)length; + + data = [OFDataArray dataArrayWithItemSize: 1 + capacity: length + 2]; + + [data addItem: &type]; [data addItem: &tmp]; } else if (length <= UINT16_MAX) { - uint8_t type = 0xD8; + uint8_t type = 0xD7; uint16_t tmp = OF_BSWAP16_IF_LE((uint16_t)length); data = [OFDataArray dataArrayWithItemSize: 1 capacity: length + 3]; [data addItem: &type]; [data addItems: &tmp count: sizeof(tmp)]; } else if (length <= UINT32_MAX) { - uint8_t type = 0xD9; + uint8_t type = 0xD8; uint32_t tmp = OF_BSWAP32_IF_LE((uint32_t)length); data = [OFDataArray dataArrayWithItemSize: 1 capacity: length + 5];