blob: 7b38943f2e489fb71708aea122feedd74e53e796 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
|
From 968c689ad2c4269a1a853434d99aa7ebf0c01354 Mon Sep 17 00:00:00 2001
From: Mans Rullgard <mans@mansr.com>
Date: Sun, 5 Nov 2017 15:57:48 +0000
Subject: [PATCH] flac: fix crash on corrupt metadata (CVE-2017-15371)
---
src/flac.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/src/flac.c b/src/flac.c
index 0d7829ec..07f45c1b 100644
--- a/src/flac.c
+++ b/src/flac.c
@@ -119,9 +119,10 @@ static void decoder_metadata_callback(FLAC__StreamDecoder const * const flac, FL
p->total_samples = metadata->data.stream_info.total_samples;
}
else if (metadata->type == FLAC__METADATA_TYPE_VORBIS_COMMENT) {
+ const FLAC__StreamMetadata_VorbisComment *vc = &metadata->data.vorbis_comment;
size_t i;
- if (metadata->data.vorbis_comment.num_comments == 0)
+ if (vc->num_comments == 0)
return;
if (ft->oob.comments != NULL) {
@@ -129,8 +130,9 @@ static void decoder_metadata_callback(FLAC__StreamDecoder const * const flac, FL
return;
}
- for (i = 0; i < metadata->data.vorbis_comment.num_comments; ++i)
- sox_append_comment(&ft->oob.comments, (char const *) metadata->data.vorbis_comment.comments[i].entry);
+ for (i = 0; i < vc->num_comments; ++i)
+ if (vc->comments[i].entry)
+ sox_append_comment(&ft->oob.comments, (char const *) vc->comments[i].entry);
}
}
--
2.25.0
|
