From 2a471c9e84ddc4f6f407d4fe3ad2a21a1d0e3723 Mon Sep 17 00:00:00 2001 From: Thomas Martitz Date: Sat, 11 Jan 2014 18:24:48 +0100 Subject: [PATCH] cuesheet: Fix another possible buffer overflow with long filenames. Change-Id: I9d8fa8fcb0a872f688664c53881fde93f2de9436 --- apps/cuesheet.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/apps/cuesheet.c b/apps/cuesheet.c index 0ba71762a9..73dd19fdab 100644 --- a/apps/cuesheet.c +++ b/apps/cuesheet.c @@ -73,11 +73,13 @@ bool look_for_cuesheet_file(struct mp3entry *track_id3, struct cuesheet_file *cu if (!dot || !file_exists(cuepath)) { strcpy(cuepath, CUE_DIR); - strlcat(cuepath, slash, MAX_PATH); + if (strlcat(cuepath, slash, MAX_PATH) >= MAX_PATH) + goto skip; /* overflow */ char *dot = strrchr(cuepath, '.'); strcpy(dot, ".cue"); if (!file_exists(cuepath)) { +skip: if ((len+4) >= MAX_PATH) return false; strlcpy(cuepath, track_id3->path, MAX_PATH);