len0rd/rockbox
1
0
Fork 1
mirror of https://github.com/Rockbox/rockbox.git synced 2025-12-07 05:35:02 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

Database: Fix memory-area bounds checking during database reload.

Browse source 
Check free space before reading new data from disk, and do not forget
to account for the RAM-cache header.

git-svn-id: svn://svn.rockbox.org/rockbox/branches/v3_9@30250 a1c6a512-1295-4272-9138-f99709370657
This commit is contained in:
Michael Hohmuth 2011-08-04 12:13:02 +00:00
parent e6d21f1d10
commit 92a578c6a7
1 changed files with 9 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

18
apps/tagcache.c
View file

@ -3909,7 +3909,7 @@ static bool load_tagcache(void)
{
struct tagcache_header *tch;
struct master_header tcmh;
long bytesleft = tc_stat.ramcache_allocated;
long bytesleft = tc_stat.ramcache_allocated - sizeof(struct ramcache_header);
struct index_entry *idx;
int rc, fd;
char *p;
@ -3947,6 +3947,14 @@ static bool load_tagcache(void)
/* Load the master index table. */
for (i = 0; i < tcmh.tch.entry_count; i++)
{
bytesleft -= sizeof(struct index_entry);
if (bytesleft < 0)
{
logf("too big tagcache.");
close(fd);
return false;
}
rc = ecread_index_entry(fd, idx);
if (rc != sizeof(struct index_entry))
{
@ -3954,14 +3962,6 @@ static bool load_tagcache(void)
close(fd);
return false;
}
bytesleft -= sizeof(struct index_entry);
if (bytesleft < 0 || ((long)idx - (long)hdr->indices) >= tc_stat.ramcache_allocated)
{
logf("too big tagcache.");
close(fd);
return false;
}
idx++;
}