[tracker] tracker-extract-mp3: Prevent possible crashes on 0-len comments
- From: Carlos Garnacho <carlosg src gnome org>
- To: commits-list gnome org
- Cc:
- Subject: [tracker] tracker-extract-mp3: Prevent possible crashes on 0-len comments
- Date: Thu, 5 May 2016 21:32:01 +0000 (UTC)
commit 30c4c84cca21cec99b4cfb50f9b0346389459f4a
Author: Carlos Garnacho <carlosg gnome org>
Date: Thu May 5 23:19:37 2016 +0200
tracker-extract-mp3: Prevent possible crashes on 0-len comments
Files may contain a COMM frame that turns out to have a 0-len
string, in our calculations the length comes out as -1, which turns
out very wrong.
https://bugzilla.gnome.org/show_bug.cgi?id=764924
src/tracker-extract/tracker-extract-mp3.c | 3 +++
1 files changed, 3 insertions(+), 0 deletions(-)
---
diff --git a/src/tracker-extract/tracker-extract-mp3.c b/src/tracker-extract/tracker-extract-mp3.c
index 04c4c09..0a13642 100644
--- a/src/tracker-extract/tracker-extract-mp3.c
+++ b/src/tracker-extract/tracker-extract-mp3.c
@@ -1293,6 +1293,9 @@ get_id3v24_tags (id3v24frame frame,
offset = 4 + text_desc_len + id3v2_nul_size (text_encode);
text = &data[pos + offset]; /* <full text string according to encoding> */
+ if (offset >= csize)
+ break;
+
word = id3v24_text_to_utf8 (text_encode, text, csize - offset, info);
if (!tracker_is_empty_string (word)) {
[
Date Prev][
Date Next] [
Thread Prev][
Thread Next]
[
Thread Index]
[
Date Index]
[
Author Index]