diff options
| author | Miika Pekkarinen <miipekk@ihme.org> | 2005-08-20 18:49:14 +0000 |
|---|---|---|
| committer | Miika Pekkarinen <miipekk@ihme.org> | 2005-08-20 18:49:14 +0000 |
| commit | fa0cecf5a9fe309e445f6146c2c49c3205ebc85e (patch) | |
| tree | cb8ea52a218310ef457a0b387251b204c5d17c96 | |
| parent | b4bdfee43cb32bebd1689fbff2409d449ce90604 (diff) | |
| download | rockbox-fa0cecf5a9fe309e445f6146c2c49c3205ebc85e.tar.gz rockbox-fa0cecf5a9fe309e445f6146c2c49c3205ebc85e.zip | |
Fixed a bug that caused codec memory allocation buffer overwrite and
vorbis codec to crash.
git-svn-id: svn://svn.rockbox.org/rockbox/trunk@7362 a1c6a512-1295-4272-9138-f99709370657
| -rw-r--r-- | apps/talk.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/apps/talk.c b/apps/talk.c index b417046a61..a1a33bb7c8 100644 --- a/apps/talk.c +++ b/apps/talk.c | |||
| @@ -210,8 +210,7 @@ static void load_voicefile(void) | |||
| 210 | cpu_boost(true); | 210 | cpu_boost(true); |
| 211 | buf = (unsigned char *)(&p_voicefile->index) + | 211 | buf = (unsigned char *)(&p_voicefile->index) + |
| 212 | (p_voicefile->id1_max + p_voicefile->id2_max) * sizeof(struct clip_entry); | 212 | (p_voicefile->id1_max + p_voicefile->id2_max) * sizeof(struct clip_entry); |
| 213 | length = file_size - offsetof(struct voicefile, index) - | 213 | length = file_size - (buf - audiobuf); |
| 214 | (p_voicefile->id1_max - p_voicefile->id2_max) * sizeof(struct clip_entry); | ||
| 215 | 214 | ||
| 216 | for (i = 0; i < length; i++) | 215 | for (i = 0; i < length; i++) |
| 217 | { | 216 | { |