diff options
| author | Thomas Jarosch <tomj@simonv.com> | 2011-02-18 21:21:50 +0000 |
|---|---|---|
| committer | Thomas Jarosch <tomj@simonv.com> | 2011-02-18 21:21:50 +0000 |
| commit | 84fccff17070ba78764ae200c4f38e0a53ff0ce7 (patch) | |
| tree | 1569ec290b455f3e93dde9e652b4ff94df3e2224 /apps/playlist.c | |
| parent | ae32e1ef06b57e71e7130ce76082cb0877aaaca5 (diff) | |
| download | rockbox-84fccff17070ba78764ae200c4f38e0a53ff0ce7.tar.gz rockbox-84fccff17070ba78764ae200c4f38e0a53ff0ce7.zip | |
Fix off-by-one buffer read access in format_track_path(). Part of #11947
We need to check for "i < max" first.
git-svn-id: svn://svn.rockbox.org/rockbox/trunk@29324 a1c6a512-1295-4272-9138-f99709370657
Diffstat (limited to 'apps/playlist.c')
| -rw-r--r-- | apps/playlist.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/apps/playlist.c b/apps/playlist.c index 6f6db27b2a..3bbe8b2f99 100644 --- a/apps/playlist.c +++ b/apps/playlist.c | |||
| @@ -1660,9 +1660,9 @@ static int format_track_path(char *dest, char *src, int buf_length, int max, | |||
| 1660 | char *temp_ptr; | 1660 | char *temp_ptr; |
| 1661 | 1661 | ||
| 1662 | /* Zero-terminate the file name */ | 1662 | /* Zero-terminate the file name */ |
| 1663 | while((src[i] != '\n') && | 1663 | while((i < max) && |
| 1664 | (src[i] != '\r') && | 1664 | (src[i] != '\n') && |
| 1665 | (i < max)) | 1665 | (src[i] != '\r')) |
| 1666 | i++; | 1666 | i++; |
| 1667 | 1667 | ||
| 1668 | /* Now work back killing white space */ | 1668 | /* Now work back killing white space */ |