Commit 6cd7817e authored by Timothy B. Terriberry's avatar Timothy B. Terriberry

Fixes for r17514 (take two).

Actually allocate the right number of comments, and add an extra check against
 i+1 overflowing (which could happen with a 4 GB comment packet on a 64-bit
 machine... unlikely, but possible).


git-svn-id: https://svn.xiph.org/trunk/Tremor@17517 0101bb08-14d6-0310-b084-bc0e0c8e3800
parent 055a48d4
......@@ -21,6 +21,7 @@
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
#include <limits.h>
#include <ogg/ogg.h>
#include "ivorbiscodec.h"
#include "codec_internal.h"
......@@ -194,9 +195,9 @@ static int _vorbis_unpack_comment(vorbis_comment *vc,oggpack_buffer *opb){
if(vc->vendor==NULL)goto err_out;
_v_readstring(opb,vc->vendor,vendorlen);
i=oggpack_read(opb,32);
if(i<0||i>(opb->storage-oggpack_bytes(opb))>>2)goto err_out;
vc->user_comments=(char **)_ogg_calloc(vc->comments+1,sizeof(*vc->user_comments));
vc->comment_lengths=(int *)_ogg_calloc(vc->comments+1, sizeof(*vc->comment_lengths));
if(i<0||i>=INT_MAX||i>(opb->storage-oggpack_bytes(opb))>>2)goto err_out;
vc->user_comments=(char **)_ogg_calloc(i+1,sizeof(*vc->user_comments));
vc->comment_lengths=(int *)_ogg_calloc(i+1, sizeof(*vc->comment_lengths));
if(vc->user_comments==NULL||vc->comment_lengths==NULL)goto err_out;
vc->comments=i;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment