mirror/taglib
1
0
Fork 0
mirror of https://github.com/taglib/taglib.git synced 2025-05-27 21:20:26 -04:00
Code Issues Packages Projects Releases Wiki Activity

Fix a possible out-of-bounds access in SynchData::decode().

Browse Source 
This also avoids an extra memory copy.
This commit is contained in:
Tsuda Kageyu 2016-02-19 20:58:09 +09:00
parent 2166d703e0
commit 8c4b484e67
2 changed files with 17 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
taglib/mpeg/id3v2/id3v2synchdata.cpp
View File

@ -77,26 +77,22 @@ ByteVector SynchData::decode(const ByteVector &data)
// We have this optimized method instead of using ByteVector::replace(),
// since it makes a great difference when decoding huge unsynchronized frames.
if(data.size() < 2)
return data;
ByteVector result(data.size());
ByteVector result = data;
ByteVector::ConstIterator src = data.begin();
ByteVector::Iterator dst = result.begin();
char *begin = result.data();
char *end = begin + result.size();
char *dst = begin;
const char *src = begin;
do {
while(src < data.end() - 1) {
*dst++ = *src++;
if(*(src - 1) == '\xff' && *src == '\x00')
src++;
}
} while(src < end);
if(src < data.end())
*dst++ = *src++;
result.resize(static_cast<unsigned int>(dst - begin));
result.resize(static_cast<unsigned int>(dst - result.begin()));
return result;
}

9
tests/test_synchdata.cpp
View File

@ -41,6 +41,7 @@ class TestID3v2SynchData : public CppUnit::TestFixture
CPPUNIT_TEST(testDecode1);
CPPUNIT_TEST(testDecode2);
CPPUNIT_TEST(testDecode3);
CPPUNIT_TEST(testDecode4);
CPPUNIT_TEST_SUITE_END();
public:
@ -113,6 +114,14 @@ public:
CPPUNIT_ASSERT_EQUAL(ByteVector("\xff\xff", 2), a);
}
void testDecode4()
{
ByteVector a("\xff\xff\xff", 3);
a = ID3v2::SynchData::decode(a);
CPPUNIT_ASSERT_EQUAL((unsigned int)3, a.size());
CPPUNIT_ASSERT_EQUAL(ByteVector("\xff\xff\xff", 3), a);
}
};
CPPUNIT_TEST_SUITE_REGISTRATION(TestID3v2SynchData);