claunia/86Box
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MDS: Fix an out of bounds fread().

Browse Source
This commit is contained in:
OBattler
2025-07-25 00:20:56 +02:00
parent 82cab486b2
commit f165e7eae3
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/cdrom/cdrom_image.c
View File

@@ -2010,7 +2010,7 @@ image_load_mds(cd_image_t *img, const char *mdsfile)
fread(&mds_dpm_block_offs, 1, sizeof(uint32_t), fp); fread(&mds_dpm_block_offs, 1, sizeof(uint32_t), fp);
fseek(fp, mds_dpm_block_offs, SEEK_SET); fseek(fp, mds_dpm_block_offs, SEEK_SET);
fread(&mds_dpm_block, 1, 4 * sizeof(mds_dpm_block_t), fp); fread(&mds_dpm_block, 1, sizeof(mds_dpm_block_t), fp);
/* We currently only support the bad sectors block and not (yet) actual DPM. */ /* We currently only support the bad sectors block and not (yet) actual DPM. */
if (mds_dpm_block.type == 0x00000002) { if (mds_dpm_block.type == 0x00000002) {
@@ -2075,7 +2075,7 @@ image_load_mds(cd_image_t *img, const char *mdsfile)
if (mds_footer.fn_is_wide) { if (mds_footer.fn_is_wide) {
int len = 0; int len = 0;
for (int i = 0; i < 256; i++) { for (int i = 0; i < 256; i++) {
fread(&wfn[i], 1, 2, fp); fread(&(wfn[i]), 1, 2, fp);
len++; len++;
if (wfn[i] == 0x0000) if (wfn[i] == 0x0000)
break; break;