claunia/flac
1
0
Fork 0
mirror of https://github.com/claunia/flac.git synced 2025-12-16 18:54:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

libFLAC: More comment validation

Browse Source 
When the allocation for obj->comment fails, set obj->num_comments
to zero.

Patch-from: lvqcl <lvqcl.mail@gmail.com>
This commit is contained in:
Erik de Castro Lopo
2015-07-05 21:21:44 +10:00
parent 5e66846a54
commit ff50779e44
3 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/libFLAC/metadata_iterators.c
View File

@@ -2255,8 +2255,10 @@ FLAC__Metadata_SimpleIteratorStatus read_metadata_block_data_vorbis_comment_cb_(
if(block->num_comments == 0) {
block->comments = 0;
}
else if(0 == (block->comments = calloc(block->num_comments, sizeof(FLAC__StreamMetadata_VorbisComment_Entry))))
else if(0 == (block->comments = calloc(block->num_comments, sizeof(FLAC__StreamMetadata_VorbisComment_Entry)))) {
block->num_comments = 0;
return FLAC__METADATA_SIMPLE_ITERATOR_STATUS_MEMORY_ALLOCATION_ERROR;
}
for(i = 0; i < block->num_comments; i++) {
status = read_metadata_block_data_vorbis_comment_entry_cb_(handle, read_cb, block->comments + i, block_length);

5
src/libFLAC/metadata_object.c
View File

@@ -574,6 +574,7 @@ FLAC_API FLAC__StreamMetadata *FLAC__metadata_object_clone(const FLAC__StreamMet
FLAC__ASSERT(0 != object->data.vorbis_comment.comments);
to->data.vorbis_comment.comments = vorbiscomment_entry_array_copy_(object->data.vorbis_comment.comments, object->data.vorbis_comment.num_comments);
if(0 == to->data.vorbis_comment.comments) {
to->data.vorbis_comment.num_comments = 0;
FLAC__metadata_object_delete(to);
return 0;
}
@@ -1195,8 +1196,10 @@ FLAC_API FLAC__bool FLAC__metadata_object_vorbiscomment_resize_comments(FLAC__St
free(object->data.vorbis_comment.comments);
object->data.vorbis_comment.comments = 0;
}
else if(0 == (object->data.vorbis_comment.comments = realloc(object->data.vorbis_comment.comments, new_size)))
else if(0 == (object->data.vorbis_comment.comments = realloc(object->data.vorbis_comment.comments, new_size))) {
object->data.vorbis_comment.num_comments = 0;
return false;
}
/* if growing, zero all the length/pointers of new elements */
if(new_size > old_size)

1
src/libFLAC/stream_decoder.c
View File

@@ -1735,6 +1735,7 @@ FLAC__bool read_metadata_vorbiscomment_(FLAC__StreamDecoder *decoder, FLAC__Stre
}
if (obj->num_comments > 0) {
if (0 == (obj->comments = safe_malloc_mul_2op_p(obj->num_comments, /*times*/sizeof(FLAC__StreamMetadata_VorbisComment_Entry)))) {
obj->num_comments = 0;
decoder->protected_->state = FLAC__STREAM_DECODER_MEMORY_ALLOCATION_ERROR;
return false;
}