From 205fba74cffffb9df985cdf928101633ffc41772 Mon Sep 17 00:00:00 2001 From: Max Kellermann Date: Fri, 16 Oct 2015 14:40:46 +0200 Subject: tag/ApeLoader: fix buffer overflow after unterminated key --- src/tag/ApeLoader.cxx | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to 'src/tag') diff --git a/src/tag/ApeLoader.cxx b/src/tag/ApeLoader.cxx index f473c910e..f51cb5c0b 100644 --- a/src/tag/ApeLoader.cxx +++ b/src/tag/ApeLoader.cxx @@ -78,12 +78,12 @@ ape_scan_internal(FILE *fp, ApeTagCallback callback) /* get the key */ const char *key = p; - while (remaining > size && *p != '\0') { - p++; - remaining--; - } - p++; - remaining--; + const char *key_end = (const char *)memchr(p, '\0', remaining); + if (key_end == nullptr) + break; + + p = key_end + 1; + remaining -= p - key; /* get the value */ if (remaining < size) -- cgit v1.2.3