diff options
| author | Erik de Castro Lopo <erikd@mega-nerd.com> | 2016-05-01 20:30:37 +1000 |
|---|---|---|
| committer | Erik de Castro Lopo <erikd@mega-nerd.com> | 2016-05-01 20:36:25 +1000 |
| commit | 516a7ad4d9c8f5cdf7039d2a4c9019404daf8a73 (patch) | |
| tree | 365cba683a2408105da0d08c5fa0fd6f201ce6bb /src/share | |
| parent | cf0a6ec709e123153a3007ff29c467ad95c96f75 (diff) | |
| download | flac-516a7ad4d9c8f5cdf7039d2a4c9019404daf8a73.tar.gz | |
flac/metaflac: Limit the size of metadata blocks
Limit allow image file size to slightly less than 2^24 bytes so that
the file size plus extra house keeping data is strictly less that
2^24 bytes in size.
Patch-from: lvqcl <lvqcl.mail@gmail.com>
Diffstat (limited to 'src/share')
| -rw-r--r-- | src/share/grabbag/picture.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/src/share/grabbag/picture.c b/src/share/grabbag/picture.c index cca4b7fe..6d0578c1 100644 --- a/src/share/grabbag/picture.c +++ b/src/share/grabbag/picture.c @@ -287,7 +287,7 @@ static const char * read_file (const char * filepath, FLAC__StreamMetadata * obj if (size < 0) return error_messages[5]; - if (size >= (1u << FLAC__STREAM_METADATA_LENGTH_LEN)) + if (size >= (1u << FLAC__STREAM_METADATA_LENGTH_LEN)) /* actual limit is less because of other fields in the PICTURE metadata block */ return error_messages[11]; if ((buffer = safe_malloc_(size)) == NULL) @@ -313,6 +313,9 @@ static const char * read_file (const char * filepath, FLAC__StreamMetadata * obj /* try to extract resolution/color info if user left it blank */ else if ((obj->data.picture.width == 0 || obj->data.picture.height == 0 || obj->data.picture.depth == 0) && !local__extract_resolution_color_info_(&obj->data.picture)) error_message = error_messages[4]; + /* check metadata block size */ + else if (obj->length >= (1u << FLAC__STREAM_METADATA_LENGTH_LEN)) + error_message = error_messages[11]; return error_message; } |