[MPlayer-cvslog] r25929 - branches/1.0rc2/stream/stream_cddb.c

[rtogni]

Author: rtogni
Date: Wed Jan 30 00:55:07 2008
New Revision: 25929

Log:
Prevent possible buffer overflow on album_title[]
Based on a patch by Adam Bozanich abozanich musecurity com

Security patch backported from r25824


Modified:
   branches/1.0rc2/stream/stream_cddb.c

Modified: branches/1.0rc2/stream/stream_cddb.c
==============================================================================
--- branches/1.0rc2/stream/stream_cddb.c	(original)
+++ branches/1.0rc2/stream/stream_cddb.c	Wed Jan 30 00:55:07 2008
@@ -53,6 +53,7 @@
 #include "version.h"
 #include "stream.h"
 #include "network.h"
+#include "libavutil/intreadwrite.h"
 
 #define DEFAULT_FREEDB_SERVER	"freedb.freedb.org"
 #define DEFAULT_CACHE_DIR	"/.cddb/"
@@ -453,8 +454,9 @@ cddb_parse_matches_list(HTTP_header_t *h
 		} else {
 			len = ptr2-ptr+1;
 		}
+		len = FFMIN(sizeof(album_title) - 1, len);
 		strncpy(album_title, ptr, len);
-		album_title[len-2]='\0';
+		album_title[len]='\0';
 	}
 	mp_msg(MSGT_DEMUX, MSGL_STATUS, MSGTR_MPDEMUX_CDDB_ParseOKFoundAlbumTitle, album_title);
 	return 0;
@@ -490,8 +492,9 @@ cddb_query_parse(HTTP_header_t *http_hdr
 				} else {
 					len = ptr2-ptr+1;
 				}
+				len = FFMIN(sizeof(album_title) - 1, len);
 				strncpy(album_title, ptr, len);
-				album_title[len-2]='\0';
+				album_title[len]='\0';
 			}
 			mp_msg(MSGT_DEMUX, MSGL_STATUS, MSGTR_MPDEMUX_CDDB_ParseOKFoundAlbumTitle, album_title);
 			return cddb_request_titles(cddb_data);