From 065266450ea5519a43bcc199e48d304f1e7038e8 Mon Sep 17 00:00:00 2001
From: Serhiy Storchaka <storchaka@gmail.com>
Date: Fri, 23 May 2014 16:13:33 +0300
Subject: [PATCH] Issue #21538: The plistlib module now supports loading of
 binary plist files when reference or offset size is not a power of two.

---
 Lib/plistlib.py           | 16 ++++++++++------
 Lib/test/test_plistlib.py | 12 ++++++++++++
 Misc/NEWS                 |  6 ++++++
 3 files changed, 28 insertions(+), 6 deletions(-)

diff --git a/Lib/plistlib.py b/Lib/plistlib.py
index dcb0f9ce964..8c148a84363 100644
--- a/Lib/plistlib.py
+++ b/Lib/plistlib.py
@@ -619,10 +619,7 @@ class _BinaryPlistParser:
                 offset_table_offset
             ) = struct.unpack('>6xBBQQQ', trailer)
             self._fp.seek(offset_table_offset)
-            offset_format = '>' + _BINARY_FORMAT[offset_size] * num_objects
-            self._ref_format = _BINARY_FORMAT[self._ref_size]
-            self._object_offsets = struct.unpack(
-                offset_format, self._fp.read(offset_size * num_objects))
+            self._object_offsets = self._read_ints(num_objects, offset_size)
             return self._read_object(self._object_offsets[top_object])
 
         except (OSError, IndexError, struct.error):
@@ -638,9 +635,16 @@ class _BinaryPlistParser:
 
         return tokenL
 
+    def _read_ints(self, n, size):
+        data = self._fp.read(size * n)
+        if size in _BINARY_FORMAT:
+            return struct.unpack('>' + _BINARY_FORMAT[size] * n, data)
+        else:
+            return tuple(int.from_bytes(data[i: i + size], 'big')
+                         for i in range(0, size * n, size))
+
     def _read_refs(self, n):
-        return struct.unpack(
-            '>' + self._ref_format * n, self._fp.read(n * self._ref_size))
+        return self._read_ints(n, self._ref_size)
 
     def _read_object(self, offset):
         """
diff --git a/Lib/test/test_plistlib.py b/Lib/test/test_plistlib.py
index bb7cc159b4a..dc2fdf696d7 100644
--- a/Lib/test/test_plistlib.py
+++ b/Lib/test/test_plistlib.py
@@ -411,6 +411,18 @@ class TestPlistlib(unittest.TestCase):
                 pl2 = plistlib.loads(data)
                 self.assertEqual(dict(pl), dict(pl2))
 
+    def test_nonstandard_refs_size(self):
+        # Issue #21538: Refs and offsets are 24-bit integers
+        data = (b'bplist00'
+                b'\xd1\x00\x00\x01\x00\x00\x02QaQb'
+                b'\x00\x00\x08\x00\x00\x0f\x00\x00\x11'
+                b'\x00\x00\x00\x00\x00\x00'
+                b'\x03\x03'
+                b'\x00\x00\x00\x00\x00\x00\x00\x03'
+                b'\x00\x00\x00\x00\x00\x00\x00\x00'
+                b'\x00\x00\x00\x00\x00\x00\x00\x13')
+        self.assertEqual(plistlib.loads(data), {'a': 'b'})
+
 
 class TestPlistlibDeprecated(unittest.TestCase):
     def test_io_deprecated(self):
diff --git a/Misc/NEWS b/Misc/NEWS
index a32df2e2c80..6bee579ba98 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -15,6 +15,12 @@ Core and Builtins
   time issue noticeable when compiling code with a large number of "and"
   and "or" operators.
 
+Library
+-------
+
+- Issue #21538: The plistlib module now supports loading of binary plist files
+  when reference or offset size is not a power of two.
+
 Tests
 -----