diff options
| author | Max Kellermann <max@duempel.org> | 2015-10-16 14:40:46 +0200 |
|---|---|---|
| committer | Max Kellermann <max@duempel.org> | 2015-10-16 14:55:40 +0200 |
| commit | 205fba74cffffb9df985cdf928101633ffc41772 (patch) | |
| tree | 62c2c672b8142ad6673674a1701499b1e3efa135 | |
| parent | a9bcf8d50dd98897db8e37d5c5141004f475d39f (diff) | |
| download | mpd-205fba74cffffb9df985cdf928101633ffc41772.tar.gz mpd-205fba74cffffb9df985cdf928101633ffc41772.tar.xz mpd-205fba74cffffb9df985cdf928101633ffc41772.zip | |
tag/ApeLoader: fix buffer overflow after unterminated key
| -rw-r--r-- | NEWS | 2 | ||||
| -rw-r--r-- | src/tag/ApeLoader.cxx | 12 |
2 files changed, 8 insertions, 6 deletions
@@ -1,4 +1,6 @@ ver 0.19.11 (not yet released) +* tags + - ape: fix buffer overflow ver 0.19.10 (2015/06/21) * input diff --git a/src/tag/ApeLoader.cxx b/src/tag/ApeLoader.cxx index f473c910e..f51cb5c0b 100644 --- a/src/tag/ApeLoader.cxx +++ b/src/tag/ApeLoader.cxx @@ -78,12 +78,12 @@ ape_scan_internal(FILE *fp, ApeTagCallback callback) /* get the key */ const char *key = p; - while (remaining > size && *p != '\0') { - p++; - remaining--; - } - p++; - remaining--; + const char *key_end = (const char *)memchr(p, '\0', remaining); + if (key_end == nullptr) + break; + + p = key_end + 1; + remaining -= p - key; /* get the value */ if (remaining < size) |