oysteikt/mpd
0
0
Fork 0
Code Issues Pull Requests Releases Activity

decoder/DsdLib: fix integer overflow in ID3 size calculation

Browse Source
This commit is contained in:
Max Kellermann 2015-01-30 23:22:49 +01:00
parent 3ecb19d0f1
commit e2e66404d5
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/decoder/plugins/DsdLib.cxx
View File

@ -117,13 +117,15 @@ dsdlib_tag_id3(InputStream &is,
if (tagoffset >= size)
return;
const id3_length_t count = size - tagoffset;
if (count < 10 || count > 1024 * 1024)
const auto count64 = size - tagoffset;
if (count64 < 10 || count64 > 1024 * 1024)
return;
if (!dsdlib_skip_to(nullptr, is, tagoffset))
return;
const id3_length_t count = count64;
id3_byte_t *const id3_buf = new id3_byte_t[count];
if (id3_buf == nullptr)
return;