aboutsummaryrefslogtreecommitdiffstats
path: root/src
diff options
context:
space:
mode:
authorMax Kellermann <max@duempel.org>2015-10-16 14:40:46 +0200
committerMax Kellermann <max@duempel.org>2015-10-16 14:55:40 +0200
commit205fba74cffffb9df985cdf928101633ffc41772 (patch)
tree62c2c672b8142ad6673674a1701499b1e3efa135 /src
parenta9bcf8d50dd98897db8e37d5c5141004f475d39f (diff)
downloadmpd-205fba74cffffb9df985cdf928101633ffc41772.tar.gz
mpd-205fba74cffffb9df985cdf928101633ffc41772.tar.xz
mpd-205fba74cffffb9df985cdf928101633ffc41772.zip
tag/ApeLoader: fix buffer overflow after unterminated key
Diffstat (limited to '')
-rw-r--r--src/tag/ApeLoader.cxx12
1 files changed, 6 insertions, 6 deletions
diff --git a/src/tag/ApeLoader.cxx b/src/tag/ApeLoader.cxx
index f473c910e..f51cb5c0b 100644
--- a/src/tag/ApeLoader.cxx
+++ b/src/tag/ApeLoader.cxx
@@ -78,12 +78,12 @@ ape_scan_internal(FILE *fp, ApeTagCallback callback)
/* get the key */
const char *key = p;
- while (remaining > size && *p != '\0') {
- p++;
- remaining--;
- }
- p++;
- remaining--;
+ const char *key_end = (const char *)memchr(p, '\0', remaining);
+ if (key_end == nullptr)
+ break;
+
+ p = key_end + 1;
+ remaining -= p - key;
/* get the value */
if (remaining < size)