From 851cac848a03fdcfc60a6681570239b5dd5e1b18 Mon Sep 17 00:00:00 2001
From: Michael Hohmuth <sideral@rockbox.org>
Date: Tue, 14 Jun 2011 20:54:26 +0000
Subject: Prevent out-of-bounds array access when a tagnavi config file defines
 too many %format specifications

git-svn-id: svn://svn.rockbox.org/rockbox/trunk@30006 a1c6a512-1295-4272-9138-f99709370657
---
 apps/tagtree.c | 6 ++++++
 1 file changed, 6 insertions(+)

(limited to 'apps/tagtree.c')

diff --git a/apps/tagtree.c b/apps/tagtree.c
index a1c5640b74..9451387a66 100644
--- a/apps/tagtree.c
+++ b/apps/tagtree.c
@@ -462,6 +462,12 @@ static int get_format_str(struct display_format *fmt)
 
 static int add_format(const char *buf)
 {
+    if (format_count >= TAGMENU_MAX_FMTS)
+    {
+        logf("too many formats");
+        return -1;
+    }
+
     strp = buf;
     
     if (formats[format_count] == NULL)
-- 
cgit v1.2.3