<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span>It would really be better to compare against sizeof(application_id) rather than coupling to all these</span></div><div><span>instances of 4 all over the place.<br></span></div><div><br></div> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Erik de Castro Lopo <mle+la@mega-nerd.com><br> <b><span style="font-weight: bold;">To:</span></b> flac-dev@xiph.org <br> <b><span style="font-weight: bold;">Sent:</span></b> Thursday, April 5, 2012 4:02:10 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [flac-dev] [PATCH] Fix buffer overflow in metaflac<br> </font> </div>
<br>Cristian Rodríguez wrote:<br><br>> strlen() returns the length excluding the terminating null byte..then<br>> an string of len 4 will be off-by-one in application_id[4];<br>> <br>> GCC 4.7 detects this bug.<br><br>Ah nice!<br><br>> diff --git a/src/metaflac/options.c b/src/metaflac/options.c<br>> index eb3498d..2cb0959 100644<br>> --- a/src/metaflac/options.c<br>> +++ b/src/metaflac/options.c<br>> @@ -1040,7 +1040,7 @@ FLAC__bool parse_block_type(const char *in, Argument_BlockType *out)<br>> out->entries[entry].type = FLAC__METADATA_TYPE_APPLICATION;<br>> out->entries[entry].filter_application_by_id = (0 != r);<br>> if(0 != r) {<br>> -
if(strlen(r) == 4) {<br>> + if(strlen(r) == 3) {<br>> strcpy(out->entries[entry].application_id, r);<br>> }<br><br><br>I actually think that this is a better solution:<br><br> if(strlen(r) == 4) {<br>- strcpy(out->entries[entry].application_id, r);<br>+ memcpy(out->entries[entry].application_id, r, 4);<br>
}<br><br><br>Cheers,<br>Erik<br>-- <br>----------------------------------------------------------------------<br>Erik de Castro Lopo<br><a href="http://www.mega-nerd.com/" target="_blank">http://www.mega-nerd.com/</a><br>_______________________________________________<br>flac-dev mailing list<br><a ymailto="mailto:flac-dev@xiph.org" href="mailto:flac-dev@xiph.org">flac-dev@xiph.org</a><br><a href="http://lists.xiph.org/mailman/listinfo/flac-dev" target="_blank">http://lists.xiph.org/mailman/listinfo/flac-dev</a><br><br><br> </div> </div> </div></body></html>