mirror/taglib
1
0
Fork 0
mirror of https://github.com/taglib/taglib.git synced 2025-06-03 09:08:09 -04:00
Code Issues Packages Projects Releases Wiki Activity

ASF: Bounds check the size of each header object

Browse Source 
UBSan spotted an integer overflow on the line `dataPos += size`, so add
a bounds check to the size that we read.
This commit is contained in:
bobsayshilol 2021-04-25 13:20:55 +01:00 committed by Urs Fleisch
parent 51ae5748cb
commit d74689cb93
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
taglib/asf/asffile.cpp
View File

@ -384,7 +384,7 @@ void ASF::File::FilePrivate::HeaderExtensionObject::parse(ASF::File *file, unsig
}
bool ok;
long long size = readQWORD(file, &ok);
if(!ok) {
if(!ok || size < 0 || size > dataSize - dataPos) {
file->setValid(false);
break;
}