diff options
author | Nils Wallménius <nils@rockbox.org> | 2011-12-21 15:47:21 +0000 |
---|---|---|
committer | Nils Wallménius <nils@rockbox.org> | 2011-12-21 15:47:21 +0000 |
commit | 2c85013434852540695bfbb74915a023d0e252ab (patch) | |
tree | 91bf7fc3eede03c582d87ca3cc29085aa94b6078 /apps/codecs/libtremor/vorbisfile.c | |
parent | 37f4dfc2597e98c7aa4922c1b32b2337c18a2ca6 (diff) | |
download | rockbox-2c85013434852540695bfbb74915a023d0e252ab.tar.gz rockbox-2c85013434852540695bfbb74915a023d0e252ab.zip |
libtremor: fix memory corruption bug introduced in r30728 that could cause crashes or playback failures for some album art infested files. Closes FS#12448.
git-svn-id: svn://svn.rockbox.org/rockbox/trunk@31393 a1c6a512-1295-4272-9138-f99709370657
Diffstat (limited to 'apps/codecs/libtremor/vorbisfile.c')
-rw-r--r-- | apps/codecs/libtremor/vorbisfile.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/apps/codecs/libtremor/vorbisfile.c b/apps/codecs/libtremor/vorbisfile.c index 44a6d6e78a..271e5a09e3 100644 --- a/apps/codecs/libtremor/vorbisfile.c +++ b/apps/codecs/libtremor/vorbisfile.c | |||
@@ -144,8 +144,11 @@ static int ogg_stream_discard_packet(OggVorbis_File *vf,ogg_page *og, | |||
144 | } | 144 | } |
145 | if (ret < 0) | 145 | if (ret < 0) |
146 | return -1; | 146 | return -1; |
147 | if (vf->os.body_fill < og->body_len) | 147 | /* We might be pretending to have filled in more of the buffer than there is |
148 | if(_os_body_expand(&vf->os, og->body_len)) | 148 | actual space, in this case the body storage must be expanded before we |
149 | start writing to it */ | ||
150 | if (vf->os.body_fill < og->body_len || vf->os.body_storage < vf->os.body_fill) | ||
151 | if(_os_body_expand(&vf->os, vf->os.body_fill - vf->os.body_storage + og->body_len)) | ||
149 | return -1; | 152 | return -1; |
150 | memcpy(vf->os.body_data+vf->os.body_fill-og->body_len, og->body, og->body_len); | 153 | memcpy(vf->os.body_data+vf->os.body_fill-og->body_len, og->body, og->body_len); |
151 | return 1; | 154 | return 1; |