openharmony/third_party_libsnd
1
0
Fork 0
mirror of https://gitee.com/openharmony/third_party_libsnd synced 2024-11-23 09:59:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

wav_write_header: don't read past the array end

Browse Source 
If loop_count is bigger than the array, truncate it to the array
length (and not to 32k).

CVE-2019-3832
This commit is contained in:
Emilio Pozuelo Monfort 2019-03-05 11:27:17 +01:00 committed by Erik de Castro Lopo
parent 7c5da26b70
commit 6d7ce94c02
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/wav.c
View File

@ -1146,8 +1146,10 @@ wav_write_header (SF_PRIVATE *psf, int calc_length)
psf_binheader_writef (psf, "44", BHW4 (0), BHW4 (0)) ; /* SMTPE format */
psf_binheader_writef (psf, "44", BHW4 (psf->instrument->loop_count), BHW4 (0)) ;
/* Loop count is signed 16 bit number so we limit it range to something sensible. */
psf->instrument->loop_count &= 0x7fff ;
/* Make sure we don't read past the loops array end. */
if (psf->instrument->loop_count > ARRAY_LEN (psf->instrument->loops))
psf->instrument->loop_count = ARRAY_LEN (psf->instrument->loops) ;
for (tmp = 0 ; tmp < psf->instrument->loop_count ; tmp++)
{ int type ;