1. 13 Jan, 2017 2 commits
  2. 06 Jan, 2017 1 commit
  3. 03 Jan, 2017 1 commit
  4. 02 Jan, 2017 1 commit
  5. 01 Jan, 2017 2 commits
  6. 24 Dec, 2016 1 commit
  7. 21 Dec, 2016 3 commits
  8. 11 Dec, 2016 3 commits
  9. 06 Dec, 2016 5 commits
  10. 05 Dec, 2016 2 commits
  11. 04 Dec, 2016 7 commits
  12. 02 Dec, 2016 1 commit
  13. 27 Oct, 2016 1 commit
  14. 04 Oct, 2016 4 commits
  15. 12 Sep, 2016 1 commit
  16. 11 Sep, 2016 1 commit
  17. 08 Sep, 2016 1 commit
  18. 14 Jul, 2016 2 commits
    • Max Kellermann's avatar
      stream_decoder: reset has_seek_table before read_metadata_seektable_() · a52177b0
      Max Kellermann authored
      
      
      If a seek table has already been read successfully, then the
      has_seek_table flag is true.  Now imagine the file comes with another
      seek table, which doesn't make sense, but libFLAC accepts it happily.
      If reading this second seek table fails (for example allocation
      failure), read_metadata_seektable_() returns false, but the
      has_seek_table flag is still true.  If the calling application happens
      to ignore this failure, and at some point tries to seek, the process
      will crash due to NULL pointer dereference.  This would sure be an
      application bug that needs to be fixed, but libFLAC's internal state
      is inconsistent, so let's fix this up.
      Signed-off-by: Erik de Castro Lopo's avatarErik de Castro Lopo <erikd@mega-nerd.com>
      a52177b0
    • Max Kellermann's avatar
      stream_decoder: fix memory leak after seek table read error · f7491f97
      Max Kellermann authored
      
      
      When read_metadata_seektable_() fails, the has_seek_table flag is
      never set to true, and thus free() is never called.
      
      Example valgrind output:
      
       11,185,464 bytes in 1 blocks are definitely lost in loss record 62 of 62
          at 0x4C2BC0F: malloc (vg_replace_malloc.c:299)
          by 0x4C2DE6F: realloc (vg_replace_malloc.c:785)
          by 0x40A7880: safe_realloc_ (alloc.h:159)
          by 0x40A7911: safe_realloc_mul_2op_ (alloc.h:205)
          by 0x40AB6B5: read_metadata_seektable_ (stream_decoder.c:1654)
          by 0x40AAB2D: read_metadata_ (stream_decoder.c:1422)
          by 0x40A9C79: FLAC__stream_decoder_process_until_end_of_metadata (stream_decoder.c:1055)
      
      It is easy to craft a FLAC file which leaks megabytes of memory on
      every attempt to open the file.
      
      This patch fixes the problem by removing checks which are unnecessary
      (and harmful).  Checking the has_seek_table flag is not enough, as
      described above.  The NULL check is not harmful, but is not helpful
      either, because free(NULL) is documented to be legal.
      
      After running this code block, we're in a well-known safe state, no
      matter how inconsistent pointer and flag may have been before, for
      whatever reasons.
      Signed-off-by: Erik de Castro Lopo's avatarErik de Castro Lopo <erikd@mega-nerd.com>
      f7491f97
  19. 13 Jul, 2016 1 commit