openharmony/third_party_libsnd
1
0
Fork 0
mirror of https://gitee.com/openharmony/third_party_libsnd synced 2024-11-23 18:09:59 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

src/(sd2|wav).c : Fix potential read beyond end of buffer.

Browse Source
This commit is contained in:
Erik de Castro Lopo 2009-03-01 20:43:30 +11:00
parent cc3b9cfaca
commit 9ebb270fb1
2 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/sd2.c
View File

@ -480,8 +480,8 @@ sd2_parse_rsrc_fork (SF_PRIVATE *psf)
goto parse_rsrc_fork_cleanup ;
} ;
if (rsrc.map_offset + 26 >= rsrc.rsrc_len)
{ psf_log_printf (psf, "Bad map offset (%d + 26 > %d).\n", rsrc.map_offset, rsrc.rsrc_len) ;
if (rsrc.map_offset + 28 >= rsrc.rsrc_len)
{ psf_log_printf (psf, "Bad map offset (%d + 28 > %d).\n", rsrc.map_offset, rsrc.rsrc_len) ;
error = SFE_SD2_BAD_RSRC ;
goto parse_rsrc_fork_cleanup ;
} ;

4
src/wav.c
View File

@ -1330,7 +1330,7 @@ wav_subchunk_parse (SF_PRIVATE *psf, int chunk)
case ISRC_MARKER :
bytesread += psf_binheader_readf (psf, "4", &dword) ;
dword += (dword & 1) ;
if (dword > SIGNED_SIZEOF (psf->u.cbuf))
if (dword >= SIGNED_SIZEOF (psf->u.cbuf))
{ psf_log_printf (psf, " *** %M : %d (too big)\n", chunk, dword) ;
psf_binheader_readf (psf, "j", dword) ;
break ;
@ -1769,7 +1769,7 @@ exif_subchunk_parse (SF_PRIVATE *psf, unsigned int length)
bytesread += sizeof (dword) ;
dword += (dword & 1) ;
if (dword > sizeof (buf))
if (dword >= sizeof (buf))
{ psf_log_printf (psf, "*** Marker '%M' is too big %u\n\n", marker, dword) ;
return bytesread ;
} ;