diff options
| author | Lars-Dominik Braun <PromyLOPh@lavabit.com> | 2009-12-15 20:05:57 +0100 |
|---|---|---|
| committer | Lars-Dominik Braun <PromyLOPh@lavabit.com> | 2009-12-15 20:06:36 +0100 |
| commit | fac7d0d211ab56d8a1357d7837dae789aa3cbf64 (patch) | |
| tree | 98cd956c8d53535366792fce6c518745387ff5de /libpiano/src/xml.c | |
| parent | 6a62ae4231c2ce10b6623e32198f40f0a2a8e777 (diff) | |
| parent | e51da0e0fb8c55cb874d87dafc7eec93bee6beb3 (diff) | |
| download | pianobar-fac7d0d211ab56d8a1357d7837dae789aa3cbf64.tar.gz pianobar-fac7d0d211ab56d8a1357d7837dae789aa3cbf64.tar.bz2 pianobar-fac7d0d211ab56d8a1357d7837dae789aa3cbf64.zip | |
Merge branch 'fuzzing'
Fixes NULL-pointer dereferences and invalid memory reads.
Diffstat (limited to 'libpiano/src/xml.c')
| -rw-r--r-- | libpiano/src/xml.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libpiano/src/xml.c b/libpiano/src/xml.c index 8d34a32..ad0cf7d 100644 --- a/libpiano/src/xml.c +++ b/libpiano/src/xml.c @@ -240,7 +240,10 @@ static void PianoXmlParsePlaylistCb (const char *key, const ezxml_t value, char *urlTail = NULL, *urlTailCrypted = &valueStr[valueStrN - urlTailN]; - if ((urlTail = PianoDecryptString (urlTailCrypted)) != NULL) { + /* don't try to decrypt if string is too short (=> invalid memory + * reads/writes) */ + if (valueStrN > urlTailN && + (urlTail = PianoDecryptString (urlTailCrypted)) != NULL) { if ((song->audioUrl = calloc (valueStrN + 1, sizeof (*song->audioUrl))) != NULL) { memcpy (song->audioUrl, valueStr, valueStrN - urlTailN); |