Rtch/Lephisto
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[Fix] Avoid possible out of bounds memory access.

Browse Source
This commit is contained in:
Allanis 2014-05-19 19:54:12 +01:00
parent ee7667be6d
commit 252f2f87b7
3 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/ai.c
View File

@ -389,7 +389,9 @@ int ai_init(void) {
suflen = strlen(AI_SUFFIX); suflen = strlen(AI_SUFFIX);
for(i = 0; i < nfiles; i++) { for(i = 0; i < nfiles; i++) {
flen = strlen(files[i]); flen = strlen(files[i]);
if(strncmp(&files[i][flen-suflen], AI_SUFFIX, suflen)==0) { if((flen > suflen) &&
strncmp(&files[i][flen-suflen], AI_SUFFIX, suflen)==0) {
snprintf(path, PATH_MAX, AI_PREFIX"%s", files[i]); snprintf(path, PATH_MAX, AI_PREFIX"%s", files[i]);
if(ai_loadProfile(path)) /* Load the profile. */ if(ai_loadProfile(path)) /* Load the profile. */
WARN("Error loading AI profile '%s'", path); WARN("Error loading AI profile '%s'", path);

4
src/music.c
View File

@ -180,7 +180,9 @@ static int music_find(void) {
suflen = strlen(MUSIC_SUFFIX); suflen = strlen(MUSIC_SUFFIX);
for(i = 0; i < nfiles; i++) { for(i = 0; i < nfiles; i++) {
flen = strlen(files[i]); flen = strlen(files[i]);
if(strncmp(&files[i][flen - suflen], MUSIC_SUFFIX, suflen)==0) { if((flen > suflen) &&
strncmp(&files[i][flen - suflen], MUSIC_SUFFIX, suflen)==0) {
/* Grow the selection size. */ /* Grow the selection size. */
nmusic_selection++; nmusic_selection++;
if(nmusic_selection > mem) { if(nmusic_selection > mem) {

4
src/sound.c
View File

@ -442,8 +442,8 @@ static int sound_makeList(void) {
suflen = strlen(SOUND_SUFFIX); suflen = strlen(SOUND_SUFFIX);
for(i = 0; i < nfiles; i++) { for(i = 0; i < nfiles; i++) {
flen = strlen(files[i]); flen = strlen(files[i]);
if(strncmp(&files[i][flen - suflen], if((flen > suflen) &&
SOUND_SUFFIX, suflen)==0) { strncmp(&files[i][flen - suflen], SOUND_SUFFIX, suflen)==0) {
/* Expand the selection size. */ /* Expand the selection size. */
sound_nlist++; sound_nlist++;