Fix for rdar://18512876

CFPropertyList.patch

--- CF-855.17/CFPropertyList.c	2014-08-15 23:19:37.000000000 +0200
+++ CF-855.17/CFPropertyList.c	2014-10-01 13:58:11.000000000 +0200
@@ -27,6 +27,7 @@
 */
 
 #include <CoreFoundation/CFPropertyList.h>
+#include <CoreFoundation/CFByteOrder.h>
 #include <CoreFoundation/CFDate.h>
 #include <CoreFoundation/CFNumber.h>
 #include <CoreFoundation/CFSet.h>
@@ -1029,7 +1030,7 @@
             return;
         case '#':
         {
-            uint16_t num = 0;
+            uint32_t num = 0;
             Boolean isHex = false;
             if ( len < 4) {  // Not enough characters to make it all fit!  Need at least "&#d;"
                 pInfo->error = __CFPropertyListCreateError(kCFPropertyListReadCorruptError, CFSTR("Encountered unexpected EOF"));
@@ -1045,10 +1046,11 @@
                 pInfo->curr ++;
                 if (ch == ';') {
                     // The value in num always refers to the unicode code point. We'll have to convert since the calling function expects UTF8 data.
-                    CFStringRef oneChar = CFStringCreateWithBytes(pInfo->allocator, (const uint8_t *)&num, 2, kCFStringEncodingUnicode, NO);
+                    num = CFSwapInt32HostToBig(num);
+                    CFStringRef oneChar = CFStringCreateWithBytes(pInfo->allocator, (const uint8_t *)&num, sizeof(num), kCFStringEncodingUTF32BE, NO);
                     uint8_t tmpBuf[6]; // max of 6 bytes for UTF8
                     CFIndex tmpBufLength = 0;
-                    CFStringGetBytes(oneChar, CFRangeMake(0, 1), kCFStringEncodingUTF8, 0, NO, tmpBuf, 6, &tmpBufLength);
+                    CFStringGetBytes(oneChar, CFRangeMake(0, CFStringGetLength(oneChar)), kCFStringEncodingUTF8, 0, NO, tmpBuf, 6, &tmpBufLength);
                     CFDataAppendBytes(stringData, tmpBuf, tmpBufLength);
                     __CFPListRelease(oneChar, pInfo->allocator);
                     return;