Prevent out-of-bounds array access when a tagnavi config file defines too many %format specifications

git-svn-id: svn://svn.rockbox.org/rockbox/trunk@30006 a1c6a512-1295-4272-9138-f99709370657

1 files changed, 6 insertions, 0 deletions

diff --git a/apps/tagtree.c b/apps/tagtree.c
index a1c5640b74..9451387a66 100644
--- a/apps/tagtree.c
+++ b/apps/tagtree.c
@@ -462,6 +462,12 @@ static int get_format_str(struct display_format *fmt)
 
 static int add_format(const char *buf)
 {
+    if (format_count >= TAGMENU_MAX_FMTS)
+    {
+        logf("too many formats");
+        return -1;
+    }
+
     strp = buf;
     
     if (formats[format_count] == NULL)