oysteikt
/
mpd
0
0
Fork 0
Code Issues Pull Requests Releases Activity

tag/ApeLoader: fix buffer overflow after unterminated key

This commit is contained in:
Max Kellermann 2015-10-16 14:40:46 +02:00
parent a9bcf8d50d
commit 205fba74cf
2 changed files with 8 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@ -1,4 +1,6 @@
ver 0.19.11 (not yet released) ver 0.19.11 (not yet released)
* tags
- ape: fix buffer overflow
ver 0.19.10 (2015/06/21) ver 0.19.10 (2015/06/21)
* input * input

12
src/tag/ApeLoader.cxx
View File

@ -78,12 +78,12 @@ ape_scan_internal(FILE *fp, ApeTagCallback callback)
/* get the key */ /* get the key */
const char *key = p; const char *key = p;
while (remaining > size && *p != '\0') { const char *key_end = (const char *)memchr(p, '\0', remaining);
p++; if (key_end == nullptr)
remaining--; break;
}
p++; p = key_end + 1;
remaining--; remaining -= p - key;
/* get the value */ /* get the value */
if (remaining < size) if (remaining < size)