From ac46a84391468dc886983955850060736404ee14 Mon Sep 17 00:00:00 2001 From: Max Kellermann Date: Mon, 5 Oct 2020 20:10:26 +0200 Subject: [PATCH] playlist/cue/parser: fix off-by-one buffer overflow cue_next_word() can return a pointer one past the end of the string if the word is followed by the terminating null byte. --- NEWS | 2 ++ src/playlist/cue/CueParser.cxx | 8 ++++++-- 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/NEWS b/NEWS index a8d8e763c..4dc6b4e06 100644 --- a/NEWS +++ b/NEWS @@ -2,6 +2,8 @@ ver 0.22.1 (not yet released) * output - alsa: don't deadlock when the ALSA driver is buggy - jack, pulse: reduce the delay when stopping or pausing playback +* playlist + - cue: fix crash bug ver 0.22 (2020/09/23) * protocol diff --git a/src/playlist/cue/CueParser.cxx b/src/playlist/cue/CueParser.cxx index a402508e2..e5bd59af4 100644 --- a/src/playlist/cue/CueParser.cxx +++ b/src/playlist/cue/CueParser.cxx @@ -38,8 +38,12 @@ cue_next_word(char *p, char **pp) while (!IsWhitespaceOrNull(*p)) ++p; - *p = 0; - *pp = p + 1; + if (*p != 0) { + *p = 0; + *pp = p + 1; + } else + *pp = p; + return word; }