changeset 442:052f21493419 trunk

[svn] I committed too fast, there was even more.
author js
date Tue, 16 Jan 2007 12:47:04 -0800
parents 86478f5b0543
children 9e76e87c857e
files ChangeLog src/tta/aud-tta.c src/tta/ttaid3tag.h
diffstat 3 files changed, 18 insertions(+), 10 deletions(-) [+]
line wrap: on
line diff
--- a/ChangeLog	Tue Jan 16 12:41:40 2007 -0800
+++ b/ChangeLog	Tue Jan 16 12:47:04 2007 -0800
@@ -1,3 +1,10 @@
+2007-01-16 20:41:40 +0000  Jonathan Schleifer <js@h3c.de>
+  revision [966]
+  Fix of possible buffer overflow.
+  trunk/src/tta/aud-tta.c |    2 +-
+  1 file changed, 1 insertion(+), 1 deletion(-)
+
+
 2007-01-16 20:17:06 +0000  Giacomo Lozito <james@develia.org>
   revision [964]
   - status icon plugin: try to auto-detect the correct size for the status icon
--- a/src/tta/aud-tta.c	Tue Jan 16 12:41:40 2007 -0800
+++ b/src/tta/aud-tta.c	Tue Jan 16 12:47:04 2007 -0800
@@ -906,7 +906,7 @@
 
 			  str = tta_input_id3_get_string (tag, ID3_FRAME_ALBUM);
 			  if(str){
-				  strcpy(ttainfo->id3v2.album, str);
+				  strncpy(ttainfo->id3v2.album, str, MAX_LINE);
 				  strncpy(ttainfo->id3v1.album, str, 30);
 			  }
 			  free(str);
@@ -914,7 +914,7 @@
 
 			  str = tta_input_id3_get_string (tag, ID3_FRAME_TITLE);
 			  if(str) {
-				  strcpy(ttainfo->id3v2.title, str);
+				  strncpy(ttainfo->id3v2.title, str, MAX_LINE);
 				  strncpy(ttainfo->id3v1.title, str, 30);
 			  }
 			  free(str);
@@ -936,7 +936,7 @@
 			  // track number
 			  str = tta_input_id3_get_string (tag, ID3_FRAME_TRACK);
 			  if(str)
-				  strcpy(ttainfo->id3v2.track, str);
+				  strncpy(ttainfo->id3v2.track, str, MAX_TRACK);
 			  free(str);
 			  str = NULL;
 
@@ -944,7 +944,7 @@
 			  str = tta_input_id3_get_string (tag, ID3_FRAME_GENRE);
 			  if(str) {
 				  id3_ucs4_t *tmp = NULL;
-				  strcpy(ttainfo->id3v2.genre, str);
+				  strncpy(ttainfo->id3v2.genre, str, MAX_GENRE);
 				  tmp = id3_latin1_ucs4duplicate((id3_latin1_t *)str);
 				  ttainfo->id3v1.genre =  id3_genre_number(tmp);
 				  g_free(tmp);
@@ -954,10 +954,8 @@
 
 			  // comment
 			  str = tta_input_id3_get_string (tag, ID3_FRAME_COMMENT);
-			  if(str) {
-				  strcpy(ttainfo->id3v2.comment, str);
+			  if(str)
 				  strncpy(ttainfo->id3v2.comment, str, 30);
-			  }
 			  free(str);
 			  str = NULL;
 
--- a/src/tta/ttaid3tag.h	Tue Jan 16 12:41:40 2007 -0800
+++ b/src/tta/ttaid3tag.h	Tue Jan 16 12:47:04 2007 -0800
@@ -8,6 +8,9 @@
 #pragma pack(1)
 
 #define MAX_LINE 4096
+#define MAX_YEAR 5
+#define MAX_TRACK 3
+#define MAX_GENRE 256
 //#define ID3_VERSION 3
 
 /* ID3 common headers set */
@@ -85,9 +88,9 @@
 	unsigned char  artist[MAX_LINE];
 	unsigned char  album[MAX_LINE];
 	unsigned char  comment[MAX_LINE];
-	unsigned char  year[5];
-	unsigned char  track[3];
-	unsigned char  genre[256];
+	unsigned char  year[MAX_YEAR];
+	unsigned char  track[MAX_TRACK];
+	unsigned char  genre[MAX_GENRE];
 	unsigned char  id3has;
 	unsigned long  size;
 } id3v2_data;