openharmony/third_party_libsnd
1
0
Fork 0
mirror of https://gitee.com/openharmony/third_party_libsnd synced 2024-11-27 03:50:29 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

src/wav.c: Fix infinite loop in exif parser

Browse Source 
Integer overflow found my American Fuzzy Lop.
This commit is contained in:
Erik de Castro Lopo 2015-12-28 16:46:28 +11:00
parent 1b93de430a
commit fdd6b8c194
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/wav.c
View File

@ -2000,7 +2000,7 @@ exif_subchunk_parse (SF_PRIVATE *psf, uint32_t length)
case olym_MARKER :
bytesread += psf_binheader_readf (psf, "4", &dword) ;
psf_log_printf (psf, "%M : %u\n", marker, dword) ;
if (bytesread + dword > length)
if (dword > length || bytesread + dword > length)
break ;
dword += (dword & 1) ;
bytesread += psf_binheader_readf (psf, "j", dword) ;