diff options
author | Nils Wallménius <nils@rockbox.org> | 2011-12-21 15:47:21 +0000 |
---|---|---|
committer | Nils Wallménius <nils@rockbox.org> | 2011-12-21 15:47:21 +0000 |
commit | 2c85013434852540695bfbb74915a023d0e252ab (patch) | |
tree | 91bf7fc3eede03c582d87ca3cc29085aa94b6078 /apps/codecs | |
parent | 37f4dfc2597e98c7aa4922c1b32b2337c18a2ca6 (diff) | |
download | rockbox-2c85013434852540695bfbb74915a023d0e252ab.tar.gz rockbox-2c85013434852540695bfbb74915a023d0e252ab.zip |
libtremor: fix memory corruption bug introduced in r30728 that could cause crashes or playback failures for some album art infested files. Closes FS#12448.
git-svn-id: svn://svn.rockbox.org/rockbox/trunk@31393 a1c6a512-1295-4272-9138-f99709370657
Diffstat (limited to 'apps/codecs')
-rw-r--r-- | apps/codecs/libtremor/vorbisfile.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/apps/codecs/libtremor/vorbisfile.c b/apps/codecs/libtremor/vorbisfile.c index 44a6d6e78a..271e5a09e3 100644 --- a/apps/codecs/libtremor/vorbisfile.c +++ b/apps/codecs/libtremor/vorbisfile.c @@ -144,8 +144,11 @@ static int ogg_stream_discard_packet(OggVorbis_File *vf,ogg_page *og, } if (ret < 0) return -1; - if (vf->os.body_fill < og->body_len) - if(_os_body_expand(&vf->os, og->body_len)) + /* We might be pretending to have filled in more of the buffer than there is + actual space, in this case the body storage must be expanded before we + start writing to it */ + if (vf->os.body_fill < og->body_len || vf->os.body_storage < vf->os.body_fill) + if(_os_body_expand(&vf->os, vf->os.body_fill - vf->os.body_storage + og->body_len)) return -1; memcpy(vf->os.body_data+vf->os.body_fill-og->body_len, og->body, og->body_len); return 1; |