89 lines
2.5 KiB
Text
89 lines
2.5 KiB
Text
$NetBSD: patch-ad,v 1.1.1.1 2010/02/16 08:59:13 wiz Exp $
|
|
|
|
Security fix, SVN r908415 from upstream 1.4.x branch.
|
|
|
|
--- amarok/src/metadata/audible/audibletag.cpp.orig 2008-08-13 23:21:51.000000000 +0200
|
|
+++ amarok/src/metadata/audible/audibletag.cpp
|
|
@@ -71,7 +71,8 @@ void Audible::Tag::readTags( FILE *fp )
|
|
{
|
|
char buf[1023];
|
|
fseek(fp, OFF_PRODUCT_ID, SEEK_SET);
|
|
- fread(buf, strlen("product_id"), 1, fp);
|
|
+ if (fread(buf, strlen("product_id"), 1, fp) != 1)
|
|
+ return;
|
|
if(memcmp(buf, "product_id", strlen("product_id")))
|
|
{
|
|
buf[20]='\0';
|
|
@@ -130,24 +131,65 @@ void Audible::Tag::readTags( FILE *fp )
|
|
|
|
bool Audible::Tag::readTag( FILE *fp, char **name, char **value)
|
|
{
|
|
+ // arbitrary value that has to be smaller than 2^32-1 and that should be large enough for all tags
|
|
+ const uint32_t maxtaglen = 100000;
|
|
+
|
|
uint32_t nlen;
|
|
- fread(&nlen, sizeof(nlen), 1, fp);
|
|
+ if (fread(&nlen, sizeof(nlen), 1, fp) != 1)
|
|
+ return false;
|
|
nlen = ntohl(nlen);
|
|
//fprintf(stderr, "tagname len=%x\n", (unsigned)nlen);
|
|
- *name = new char[nlen+1];
|
|
- (*name)[nlen] = '\0';
|
|
+ if (nlen > maxtaglen)
|
|
+ return false;
|
|
|
|
uint32_t vlen;
|
|
- fread(&vlen, sizeof(vlen), 1, fp);
|
|
+ if (fread(&vlen, sizeof(vlen), 1, fp) != 1)
|
|
+ return false;
|
|
vlen = ntohl(vlen);
|
|
//fprintf(stderr, "tag len=%x\n", (unsigned)vlen);
|
|
+ if (vlen > maxtaglen)
|
|
+ return false;
|
|
+
|
|
+ *name = new char[nlen+1];
|
|
+ if (!*name)
|
|
+ return false;
|
|
+
|
|
*value = new char[vlen+1];
|
|
+ if (!*value)
|
|
+ {
|
|
+ delete[] *name;
|
|
+ *name = 0;
|
|
+ return false;
|
|
+ }
|
|
+
|
|
+ (*name)[nlen] = '\0';
|
|
(*value)[vlen] = '\0';
|
|
|
|
- fread(*name, nlen, 1, fp);
|
|
- fread(*value, vlen, 1, fp);
|
|
+ if (fread(*name, nlen, 1, fp) != 1)
|
|
+ {
|
|
+ delete[] *name;
|
|
+ *name = 0;
|
|
+ delete[] *value;
|
|
+ *value = 0;
|
|
+ return false;
|
|
+ }
|
|
+ if (fread(*value, vlen, 1, fp) != 1)
|
|
+ {
|
|
+ delete[] *name;
|
|
+ *name = 0;
|
|
+ delete[] *value;
|
|
+ *value = 0;
|
|
+ return false;
|
|
+ }
|
|
char lasttag;
|
|
- fread(&lasttag, 1, 1, fp);
|
|
+ if (fread(&lasttag, 1, 1, fp) != 1)
|
|
+ {
|
|
+ delete[] *name;
|
|
+ *name = 0;
|
|
+ delete[] *value;
|
|
+ *value = 0;
|
|
+ return false;
|
|
+ }
|
|
//fprintf(stderr, "%s: \"%s\"\n", *name, *value);
|
|
|
|
m_tagsEndOffset += 2 * 4 + nlen + vlen + 1;
|