Nyaaori/rockbox
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Database: Fix memory-area bounds checking during database reload.

Browse source 
Check free space before reading new data from disk, and do not forget
to account for the RAM-cache header.

git-svn-id: svn://svn.rockbox.org/rockbox/trunk@30246 a1c6a512-1295-4272-9138-f99709370657
This commit is contained in:
Michael Hohmuth 2011-08-04 10:21:40 +00:00
parent 95c1e7d8b0
commit 4cb473562e
1 changed files with 9 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
apps/tagcache.c
View file

@ -3905,7 +3905,7 @@ static bool load_tagcache(void)
{ {
struct tagcache_header *tch; struct tagcache_header *tch;
struct master_header tcmh; struct master_header tcmh;
long bytesleft = tc_stat.ramcache_allocated; long bytesleft = tc_stat.ramcache_allocated - sizeof(struct ramcache_header);
struct index_entry *idx; struct index_entry *idx;
int rc, fd; int rc, fd;
char *p; char *p;
@ -3943,6 +3943,14 @@ static bool load_tagcache(void)
/* Load the master index table. */ /* Load the master index table. */
for (i = 0; i < tcmh.tch.entry_count; i++) for (i = 0; i < tcmh.tch.entry_count; i++)
{ {
bytesleft -= sizeof(struct index_entry);
if (bytesleft < 0)
{
logf("too big tagcache.");
close(fd);
return false;
}
/* DEBUG: After tagcache commit and dircache rebuild, hdr-sturcture /* DEBUG: After tagcache commit and dircache rebuild, hdr-sturcture
* may become corrupt. */ * may become corrupt. */
rc = ecread_index_entry(fd, idx); rc = ecread_index_entry(fd, idx);
@ -3953,15 +3961,6 @@ static bool load_tagcache(void)
return false; return false;
} }
bytesleft -= sizeof(struct index_entry);
if (bytesleft < 0 ||
((long)idx - (long)ramcache_hdr->indices) >= tc_stat.ramcache_allocated)
{
logf("too big tagcache.");
close(fd);
return false;
}
idx++; idx++;
} }