[xiph-commits] r14502 - trunk/vorbis/lib

[giles at svn.xiph.org]

Author: giles
Date: 2008-02-13 13:50:25 -0800 (Wed, 13 Feb 2008)
New Revision: 14502

Modified:
   trunk/vorbis/lib/info.c
Log:
Don't try to read past the end of the comment packet if the string lengths 
are corrupt.


Modified: trunk/vorbis/lib/info.c
===================================================================
--- trunk/vorbis/lib/info.c	2008-02-13 21:00:11 UTC (rev 14501)
+++ trunk/vorbis/lib/info.c	2008-02-13 21:50:25 UTC (rev 14502)
@@ -236,17 +236,21 @@
   int i;
   int vendorlen=oggpack_read(opb,32);
   if(vendorlen<0)goto err_out;
+  if(vendorlen+8>opb->storage)goto err_out;
   vc->vendor=_ogg_calloc(vendorlen+1,1);
   _v_readstring(opb,vc->vendor,vendorlen);
-  vc->comments=oggpack_read(opb,32);
-  if(vc->comments<0)goto err_out;
+  i=oggpack_read(opb,32);
+  if(i<0)goto err_out;
+  if(4*i+oggpack_bytes(opb)>opb->storage)goto err_out;
+  vc->comments=i;
   vc->user_comments=_ogg_calloc(vc->comments+1,sizeof(*vc->user_comments));
   vc->comment_lengths=_ogg_calloc(vc->comments+1, sizeof(*vc->comment_lengths));
 	    
   for(i=0;i<vc->comments;i++){
     int len=oggpack_read(opb,32);
     if(len<0)goto err_out;
-	vc->comment_lengths[i]=len;
+    if(len+oggpack_bytes(opb)>opb->storage)goto err_out;
+    vc->comment_lengths[i]=len;
     vc->user_comments[i]=_ogg_calloc(len+1,1);
     _v_readstring(opb,vc->user_comments[i],len);
   }