[PATCH] Fix potential overflow in get_metadata
There is at least one potential heap overflow in mplayer.c:get_metadata: meta = malloc (8); sprintf (meta, "0x%08X", sh_video->format); So here is a patch to change the way "meta" is handled in this function. -- Clément B. Not sent from a jesusPhone.
On Thu, Dec 16, 2010 at 11:07:00PM +0100, Clément Bœsch wrote:
There is at least one potential heap overflow in mplayer.c:get_metadata:
meta = malloc (8); sprintf (meta, "0x%08X", sh_video->format);
So here is a patch to change the way "meta" is handled in this function.
No news on this, so I suppose it's fine; I'm going to wait 3 more days and commit it if there is no objection. -- Clément B. Not sent from a jesusPhone.
On Thu, Dec 16, 2010 at 11:07:00PM +0100, Clément Bœsch wrote:
char *get_metadata (metadata_t type) { - char *meta = NULL; + char meta[16];
Please use something like 100, this one: "%d Hz, %d ch.", while not for valid values, in general can already expand to 36 bytes or so. Seems ok otherwise, I was thinking about factoring out the strdup(meta) but I suspect it might be a bad idea.
On Sun, Dec 19, 2010 at 01:03:57PM +0100, Reimar Döffinger wrote:
On Thu, Dec 16, 2010 at 11:07:00PM +0100, Clément Bœsch wrote:
char *get_metadata (metadata_t type) { - char *meta = NULL; + char meta[16];
Please use something like 100, this one: "%d Hz, %d ch.", while not for valid values, in general can already expand to 36 bytes or so.
Applied, with 128.
Seems ok otherwise, I was thinking about factoring out the strdup(meta) but I suspect it might be a bad idea.
Yes, I intentionally avoided the goto here. -- Clément B. Not sent from a jesusPhone.
participants (2)
-
Clément Bœsch -
Reimar Döffinger