Nyaaori/rockbox
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

libtremor: fix memory corruption bug introduced in r30728 that could cause crashes or playback failures for some album art infested files. Closes FS#12448.

Browse source 
git-svn-id: svn://svn.rockbox.org/rockbox/trunk@31393 a1c6a512-1295-4272-9138-f99709370657
This commit is contained in:
Nils Wallménius 2011-12-21 15:47:21 +00:00
parent 37f4dfc259
commit 2c85013434
1 changed files with 5 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
apps/codecs/libtremor/vorbisfile.c
View file

@ -144,8 +144,11 @@ static int ogg_stream_discard_packet(OggVorbis_File *vf,ogg_page *og,
} }
if (ret < 0) if (ret < 0)
return -1; return -1;
if (vf->os.body_fill < og->body_len) /* We might be pretending to have filled in more of the buffer than there is
if(_os_body_expand(&vf->os, og->body_len)) actual space, in this case the body storage must be expanded before we
start writing to it */
if (vf->os.body_fill < og->body_len || vf->os.body_storage < vf->os.body_fill)
if(_os_body_expand(&vf->os, vf->os.body_fill - vf->os.body_storage + og->body_len))
return -1; return -1;
memcpy(vf->os.body_data+vf->os.body_fill-og->body_len, og->body, og->body_len); memcpy(vf->os.body_data+vf->os.body_fill-og->body_len, og->body, og->body_len);
return 1; return 1;