From 968c689ad2c4269a1a853434d99aa7ebf0c01354 Mon Sep 17 00:00:00 2001 From: Mans Rullgard <mans@mansr.com> Date: Sun, 5 Nov 2017 15:57:48 +0000 Subject: [PATCH] flac: fix crash on corrupt metadata (CVE-2017-15371) --- src/flac.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/flac.c b/src/flac.c index 0d7829ec..07f45c1b 100644 --- a/src/flac.c +++ b/src/flac.c @@ -119,9 +119,10 @@ static void decoder_metadata_callback(FLAC__StreamDecoder const * const flac, FL p->total_samples = metadata->data.stream_info.total_samples; } else if (metadata->type == FLAC__METADATA_TYPE_VORBIS_COMMENT) { + const FLAC__StreamMetadata_VorbisComment *vc = &metadata->data.vorbis_comment; size_t i; - if (metadata->data.vorbis_comment.num_comments == 0) + if (vc->num_comments == 0) return; if (ft->oob.comments != NULL) { @@ -129,8 +130,9 @@ static void decoder_metadata_callback(FLAC__StreamDecoder const * const flac, FL return; } - for (i = 0; i < metadata->data.vorbis_comment.num_comments; ++i) - sox_append_comment(&ft->oob.comments, (char const *) metadata->data.vorbis_comment.comments[i].entry); + for (i = 0; i < vc->num_comments; ++i) + if (vc->comments[i].entry) + sox_append_comment(&ft->oob.comments, (char const *) vc->comments[i].entry); } } -- 2.25.0