mp3utils.c (musicmatch): more sanity checks. image check is no longer paranoid.
authorOzkan Sezer
Wed, 11 Dec 2019 22:20:02 +0300
changeset 107738ae3fb1962a
parent 1076 c3eace8f616a
child 1078 092f7e1f97b9
mp3utils.c (musicmatch): more sanity checks. image check is no longer paranoid.
src/codecs/mp3utils.c
     1.1 --- a/src/codecs/mp3utils.c	Wed Dec 11 18:56:50 2019 +0300
     1.2 +++ b/src/codecs/mp3utils.c	Wed Dec 11 22:20:02 2019 +0300
     1.3 @@ -224,6 +224,7 @@
     1.4      imgext_ofs  = (Sint32)((buf[3] <<24) | (buf[2] <<16) | (buf[1] <<8) | buf[0] );
     1.5      version_ofs = (Sint32)((buf[15]<<24) | (buf[14]<<16) | (buf[13]<<8) | buf[12]);
     1.6      if (version_ofs <= imgext_ofs) return -1;
     1.7 +    if (version_ofs <= 0 || imgext_ofs <= 0) return -1;
     1.8      /* Try finding the version info section:
     1.9       * Because metadata section comes after it, and because metadata section
    1.10       * has different sizes across versions (format ver. <= 3.00: always 7868
    1.11 @@ -247,22 +248,21 @@
    1.12          }
    1.13      }
    1.14      if (i == 4) return -1; /* no luck. */
    1.15 -    (void) (j = 0);
    1.16      #ifdef MMTAG_PARANOID
    1.17      /* unused section: (4 bytes of 0x00) */
    1.18      MP3_RWseek(m, -(len + 4), RW_SEEK_END);
    1.19 -    MP3_RWread(m, buf, 1, 4);
    1.20 +    MP3_RWread(m, buf, 1, 4); j = 0;
    1.21      if (SDL_memcmp(buf, &j, 4) != 0) return -1;
    1.22      #endif
    1.23      len += (version_ofs - imgext_ofs);
    1.24      if (m->length < len) return -1;
    1.25 -    #ifdef MMTAG_PARANOID
    1.26      MP3_RWseek(m, -len, RW_SEEK_END);
    1.27      MP3_RWread(m, buf, 1, 8);
    1.28      j = (Sint32)((buf[7] <<24) | (buf[6] <<16) | (buf[5] <<8) | buf[4]);
    1.29 +    if (j < 0) return -1;
    1.30      /* verify image size: */
    1.31 +    /* without this, we may land at a wrong place. */
    1.32      if (j + 12 != version_ofs - imgext_ofs) return -1;
    1.33 -    #endif
    1.34      /* try finding the optional header */
    1.35      if (m->length < len + 256) return len;
    1.36      MP3_RWseek(m, -(len + 256), RW_SEEK_END);