[tracker] tracker-extract-mp3: Prevent possible crashes on 0-len comments



commit 30c4c84cca21cec99b4cfb50f9b0346389459f4a
Author: Carlos Garnacho <carlosg gnome org>
Date:   Thu May 5 23:19:37 2016 +0200

    tracker-extract-mp3: Prevent possible crashes on 0-len comments
    
    Files may contain a COMM frame that turns out to have a 0-len
    string, in our calculations the length comes out as -1, which turns
    out very wrong.
    
    https://bugzilla.gnome.org/show_bug.cgi?id=764924

 src/tracker-extract/tracker-extract-mp3.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)
---
diff --git a/src/tracker-extract/tracker-extract-mp3.c b/src/tracker-extract/tracker-extract-mp3.c
index 04c4c09..0a13642 100644
--- a/src/tracker-extract/tracker-extract-mp3.c
+++ b/src/tracker-extract/tracker-extract-mp3.c
@@ -1293,6 +1293,9 @@ get_id3v24_tags (id3v24frame           frame,
                offset        = 4 + text_desc_len + id3v2_nul_size (text_encode);
                text          = &data[pos + offset]; /* <full text string according to encoding> */
 
+               if (offset >= csize)
+                       break;
+
                word = id3v24_text_to_utf8 (text_encode, text, csize - offset, info);
 
                if (!tracker_is_empty_string (word)) {


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]