storm/minidlna
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

* Fix an invalid read if the last RIFF tag is an integer value.

Browse Source
This commit is contained in:
Justin Maggard 2011-09-01 01:16:22 +00:00
parent 1e23a1e8e9
commit 63869c9e17
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
tagutils/tagutils-wav.c
View File

@ -148,7 +148,7 @@ _get_wavtags(char *filename, struct song_metadata *psong)
if(len > 65536) if(len > 65536)
goto next_block; goto next_block;
tags = malloc(len); tags = malloc(len+1);
if(!tags) if(!tags)
goto next_block; goto next_block;
@ -158,6 +158,7 @@ _get_wavtags(char *filename, struct song_metadata *psong)
free(tags); free(tags);
goto next_block; goto next_block;
} }
tags[len] = '\0';
off = 4; off = 4;
p = tags + off; p = tags + off;
@ -165,7 +166,7 @@ _get_wavtags(char *filename, struct song_metadata *psong)
{ {
taglen = GET_WAV_INT32(p + 4); taglen = GET_WAV_INT32(p + 4);
//DEBUG DPRINTF(E_DEBUG, L_SCANNER, "%.*s: %.*s\n", 4, p, taglen, p + 8); //DEBUG DPRINTF(E_DEBUG, L_SCANNER, "%.*s: %.*s (%d)\n", 4, p, taglen, p + 8, taglen);
m = NULL; m = NULL;
if (taglen > 2048) { if (taglen > 2048) {
DPRINTF(E_WARN, L_SCANNER, "Ignoring long tag [%.*s] in %s\n", DPRINTF(E_WARN, L_SCANNER, "Ignoring long tag [%.*s] in %s\n",