diff options
author | Nils Wallménius <nils@rockbox.org> | 2010-12-06 17:15:00 +0000 |
---|---|---|
committer | Nils Wallménius <nils@rockbox.org> | 2010-12-06 17:15:00 +0000 |
commit | c28778fb5a01b9b70a66e460bef5de82a36c2b96 (patch) | |
tree | 8c4ed13e180d5da6d2728a81cc35e4c921cfb40a /apps/codecs | |
parent | bdf8a243fa0d2d33475ab8b7fd61d791dfcea94f (diff) | |
download | rockbox-c28778fb5a01b9b70a66e460bef5de82a36c2b96.tar.gz rockbox-c28778fb5a01b9b70a66e460bef5de82a36c2b96.zip |
libtremor: merge part of upstream revision 17514 adding some limit checking for allocations when unpacking comments.
git-svn-id: svn://svn.rockbox.org/rockbox/trunk@28748 a1c6a512-1295-4272-9138-f99709370657
Diffstat (limited to 'apps/codecs')
-rw-r--r-- | apps/codecs/libtremor/info.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/apps/codecs/libtremor/info.c b/apps/codecs/libtremor/info.c index f3ac5f87f6..62a31d510e 100644 --- a/apps/codecs/libtremor/info.c +++ b/apps/codecs/libtremor/info.c | |||
@@ -140,11 +140,15 @@ static int _vorbis_unpack_info(vorbis_info *vi,oggpack_buffer *opb){ | |||
140 | } | 140 | } |
141 | 141 | ||
142 | static int _vorbis_unpack_comment(vorbis_comment *vc,oggpack_buffer *opb){ | 142 | static int _vorbis_unpack_comment(vorbis_comment *vc,oggpack_buffer *opb){ |
143 | int vendorlen=oggpack_read(opb,32); | 143 | int vendorlen; |
144 | vendorlen=oggpack_read(opb,32); | ||
144 | if(vendorlen<0)goto err_out; | 145 | if(vendorlen<0)goto err_out; |
146 | if(vendorlen>opb->storage-oggpack_bytes(opb))goto err_out; | ||
145 | vc->vendor=(char *)_ogg_calloc(vendorlen+1,1); | 147 | vc->vendor=(char *)_ogg_calloc(vendorlen+1,1); |
148 | if(vc->vendor==NULL)goto err_out; | ||
146 | _v_readstring(opb,vc->vendor,vendorlen); | 149 | _v_readstring(opb,vc->vendor,vendorlen); |
147 | vc->comments=0; | 150 | vc->comments=0; |
151 | /* ROCKBOX: the meat of this function was deleted as we don't need it */ | ||
148 | return(0); | 152 | return(0); |
149 | err_out: | 153 | err_out: |
150 | vorbis_comment_clear(vc); | 154 | vorbis_comment_clear(vc); |