Skip to content

Plist recursekey fix#5108

Open
oh6hay wants to merge 3 commits into
log2timeline:mainfrom
oh6hay:plist-recursekey-fix
Open

Plist recursekey fix#5108
oh6hay wants to merge 3 commits into
log2timeline:mainfrom
oh6hay:plist-recursekey-fix

Conversation

@oh6hay
Copy link
Copy Markdown

@oh6hay oh6hay commented May 28, 2026

One line description of pull request

Fixes the plist parser hanging for an exponentially long time attempting to recurse a valid PLIST that contains a very large number of unique paths to a small number of leaf nodes, using shared references

Description:

This fixes an issue with the plist parser interface's _RecurseKey method. For list elements, the _RecurseKey recurses into each list element independently, not checking if the references in a list point to a target already recursed into. This allows constructing a bplist representing a chain of lists, so that each list contains multiple references to the next element in the chain. The _RecurseKey naively recurses into each reference independently, not checking if it traverses into a node already traversed. The depth check doesn't help here as 15 is plenty of levels to construct an exponentially large amount of unique paths in the chain. This is fixed by also passing a set of already visited objects on the method call. The change also protects against cyclic references, as a treat.

Notes:

All contributions to Plaso undergo code review.
This makes sure that the code has appropriate test coverage and conforms to the
Plaso style guide.

One of the maintainers will examine your code, and may request changes. Check off the items below in
order, and then a maintainer will review your code.

Checklist:

  • No new new dependencies are required or l2tdevtools has been updated.
  • Test data has a Plaso compatible license. If the test data was not authored by you (the contributor), make sure to mention its original source in ACKNOWLEDGEMENTS.
  • Reviewer assigned.
  • Automated checks (GitHub Actions, AppVeyor) pass.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant