devs/foxbox
1
0
Fork 0
forked from len0rd/rockbox
Code Pull requests Activity

cuesheet: Fix possible buffer overflow with long filenames.

Browse source 
Change-Id: I49fe6da35057895d3c5a08a8723afe41eef7afe8
This commit is contained in:
Thomas Martitz 2014-01-11 18:01:22 +01:00
parent 8c286b4686
commit fe08ac4c2f
1 changed files with 11 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

18
apps/cuesheet.c
View file

@ -45,9 +45,9 @@
bool look_for_cuesheet_file(struct mp3entry *track_id3, struct cuesheet_file *cue_file)
{
/* DEBUGF("look for cue file\n"); */
size_t len;
char cuepath[MAX_PATH];
char *dot, *slash;
char *dot, *slash, *slash_cuepath;
if (track_id3->has_embedded_cuesheet)
{
@ -64,18 +64,22 @@ bool look_for_cuesheet_file(struct mp3entry *track_id3, struct cuesheet_file *cu
slash = strrchr(track_id3->path, '/');
if (!slash)
return false;
strlcpy(cuepath, track_id3->path, MAX_PATH);
dot = strrchr(cuepath, '.');
strcpy(dot, ".cue");
len = strlcpy(cuepath, track_id3->path, MAX_PATH);
slash_cuepath = &cuepath[slash - track_id3->path];
dot = strrchr(slash_cuepath, '.');
if (dot)
strlcpy(dot, ".cue", MAX_PATH - (dot-cuepath));
if (!file_exists(cuepath))
if (!dot || !file_exists(cuepath))
{
strcpy(cuepath, CUE_DIR);
strcat(cuepath, slash);
strlcat(cuepath, slash, MAX_PATH);
char *dot = strrchr(cuepath, '.');
strcpy(dot, ".cue");
if (!file_exists(cuepath))
{
if ((len+4) >= MAX_PATH)
return false;
strlcpy(cuepath, track_id3->path, MAX_PATH);
strlcat(cuepath, ".cue", MAX_PATH);
if (!file_exists(cuepath))