claunia/flac
1
0
Fork 0
mirror of https://github.com/claunia/flac.git synced 2025-12-16 18:54:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

extra checking on memory allocation sizes to prevent a class of overflow attacks

Browse Source
This commit is contained in:
Josh Coalson
2007-09-11 04:49:56 +00:00
parent 0221d87c89
commit 0f008d2e9e
26 changed files with 234 additions and 115 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
src/plugin_winamp2/configure.c
View File

@@ -26,6 +26,7 @@
#include "configure.h"
#include "tagz.h"
#include "resource.h"
#include "share/alloc.h"
static char buffer[256];
@@ -52,7 +53,7 @@ static wchar_t *convert_ansi_to_wide_(const char *src)
len = strlen(src) + 1;
/* copy */
dest = malloc(len*sizeof(wchar_t));
dest = safe_malloc_mul_2op_(len, /*times*/sizeof(wchar_t));
if (dest) mbstowcs(dest, src, len);
return dest;
}

3
src/plugin_winamp2/in_flac.c
View File

@@ -24,6 +24,7 @@
#include <limits.h> /* for INT_MAX */
#include <stdio.h>
#include "share/alloc.h"
#include "winamp2/in2.h"
#include "configure.h"
#include "infobox.h"
@@ -279,7 +280,7 @@ static T_CHAR *get_tag(const T_CHAR *tag, void *param)
if (!tag)
return 0;
/* Vorbis comment names must be ASCII, so convert 'tag' first */
tagname = malloc(wcslen(tag)+1);
tagname = safe_malloc_add_2op_(wcslen(tag), /*+*/1);
for(p=tagname;*tag;) {
if(*tag > 0x7d) {
free(tagname);

5
src/plugin_winamp2/infobox.c
View File

@@ -23,6 +23,7 @@
#include <windows.h>
#include <stdio.h>
#include "FLAC/all.h"
#include "share/alloc.h"
#include "plugin_common/all.h"
#include "infobox.h"
#include "configure.h"
@@ -74,7 +75,7 @@ static void LoadGenres()
hFile = CreateFile(buffer, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
if (hFile == INVALID_HANDLE_VALUE) return;
genresSize = GetFileSize(hFile, 0);
if (genresSize && (genres = (char*)malloc(genresSize+2)))
if (genresSize && (genres = (char*)safe_malloc_add_2op_(genresSize, /*+*/2)))
{
if (!ReadFile(hFile, genres, genresSize, &spam, NULL) || spam!=genresSize)
{
@@ -187,7 +188,7 @@ static wchar_t *AnsiToWide(const char *src)
len = strlen(src) + 1;
/* copy */
dest = (wchar_t*)malloc(len*sizeof(wchar_t));
dest = (wchar_t*)safe_malloc_mul_2op_(len, /*times*/sizeof(wchar_t));
if (dest) mbstowcs(dest, src, len);
return dest;
}