oysteikt
/
mpd
0
0
Fork 0
Code Issues Pull Requests Releases Activity

output/httpd/IcyMetaDataServer: cast length to unsigned 

Fixes another buffer overflow: if the stream has a very long title or
URL, resulting in a metadata string of more than 2 kB, icy_string[0]
is a negative value, which gets casted to size_t - ouch!

 https://bugs.musicpd.org/view.php?id=4652
This commit is contained in:
Max Kellermann 2017-02-19 19:11:04 +01:00
parent a73195b7cc
commit 4bb83781e8
2 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
NEWS
View File

@ -3,6 +3,8 @@ ver 0.20.5 (not yet released)
- id3: fix memory leak on corrupt ID3 tags - id3: fix memory leak on corrupt ID3 tags
* decoder * decoder
- sidplay: don't require libsidutils when building with libsidplayfp - sidplay: don't require libsidutils when building with libsidplayfp
* output
- httpd: fix two buffer overflows in IcyMetaData length calculation
* mixer * mixer
- alsa: fix crash bug - alsa: fix crash bug

2
src/output/plugins/httpd/IcyMetaDataServer.cxx
View File

@ -113,5 +113,5 @@ icy_server_metadata_page(const Tag &tag, const TagType *types)
if (icy_string.IsNull()) if (icy_string.IsNull())
return nullptr; return nullptr;
return Page::Copy(icy_string.c_str(), (icy_string[0] * 16) + 1); return Page::Copy(icy_string.c_str(), uint8_t(icy_string[0]) * 16 + 1);
} }