File fix-buffer-overflow.patch of Package soundtouch.8638

Overview Repositories Revisions Requests Users Attributes Meta

File fix-buffer-overflow.patch of Package soundtouch.8638

Index: soundtouch/source/SoundStretch/WavFile.cpp
===================================================================
--- soundtouch.orig/source/SoundStretch/WavFile.cpp
+++ soundtouch/source/SoundStretch/WavFile.cpp
@@ -527,12 +527,16 @@ int WavInFile::readHeaderBlock()
         // read length of the format field
         if (fread(&nLen, sizeof(int), 1, fptr) != 1) return -1;
         // swap byte order if necessary
-        _swap32(nLen); // int format_len;
-        header.format.format_len = nLen;
+        _swap32(nLen);
 
-        // calculate how much length differs from expected
+        // calculate how much length differs from expected 
         nDump = nLen - ((int)sizeof(header.format) - 8);
 
+        // verify that header length isn't smaller than expected structure
+        if ((nLen < 0) || (nDump < 0)) return -1;
+
+        header.format.format_len = nLen;
+
         // if format_len is larger than expected, read only as much data as we've space for
         if (nDump > 0)
         {

Places

File fix-buffer-overflow.patch of Package soundtouch.8638

Places