forked from pool/libquicktime
d761c3967f
- adjust libquicktime-1.2.4-integer_overflow.patch to prevent endless loop when there are less than 256 bytes to read [bsc#1022805] CVE-2016-2399 OBS-URL: https://build.opensuse.org/request/show/508079 OBS-URL: https://build.opensuse.org/package/show/multimedia:libs/libquicktime?expand=0&rev=72
23 lines
731 B
Diff
23 lines
731 B
Diff
Index: libquicktime/src/util.c
|
|
===================================================================
|
|
--- libquicktime.orig/src/util.c
|
|
+++ libquicktime/src/util.c
|
|
@@ -376,9 +376,14 @@ int64_t quicktime_byte_position(quicktim
|
|
|
|
void quicktime_read_pascal(quicktime_t *file, char *data)
|
|
{
|
|
- char len = quicktime_read_char(file);
|
|
- quicktime_read_data(file, (uint8_t*)data, len);
|
|
- data[(int)len] = 0;
|
|
+ int len = quicktime_read_char(file);
|
|
+ if ((len > 0) && (len < 256)) {
|
|
+ /* data[] is expected to be 256 bytes long */
|
|
+ quicktime_read_data(file, (uint8_t*)data, len);
|
|
+ data[len] = 0;
|
|
+ } else {
|
|
+ data[0] = 0;
|
|
+ }
|
|
}
|
|
|
|
void quicktime_write_pascal(quicktime_t *file, char *data)
|