libtremor: fix memory corruption bug introduced in r30728 that could cause crashes or playback failures for some album art infested files. Closes FS#12448.

git-svn-id: svn://svn.rockbox.org/rockbox/trunk@31393 a1c6a512-1295-4272-9138-f99709370657

1 files changed, 5 insertions, 2 deletions

diff --git a/apps/codecs/libtremor/vorbisfile.c b/apps/codecs/libtremor/vorbisfile.c
index 44a6d6e78a..271e5a09e3 100644
--- a/apps/codecs/libtremor/vorbisfile.c
+++ b/apps/codecs/libtremor/vorbisfile.c
@@ -144,8 +144,11 @@ static int ogg_stream_discard_packet(OggVorbis_File *vf,ogg_page *og,
   }
   if (ret < 0)
     return -1;
-  if (vf->os.body_fill < og->body_len)
-    if(_os_body_expand(&vf->os, og->body_len))
+  /* We might be pretending to have filled in more of the buffer than there is
+     actual space, in this case the body storage must be expanded before we
+     start writing to it */
+  if (vf->os.body_fill < og->body_len || vf->os.body_storage < vf->os.body_fill)
+    if(_os_body_expand(&vf->os, vf->os.body_fill - vf->os.body_storage + og->body_len))
       return -1;
   memcpy(vf->os.body_data+vf->os.body_fill-og->body_len, og->body, og->body_len);
   return 1;