TakeV/dxx-rebirth
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Make sure read_m3u won't read past the end of the buffer, causing a crash

Browse source
This commit is contained in:
Chris Taylor 2010-11-13 13:10:57 +08:00
parent 88b5205135
commit f5c21d249c
3 changed files with 10 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
CHANGELOG.txt
View file

@ -3,6 +3,7 @@ D1X-Rebirth Changelog
20101113
--------
main/playsave.c: In plyr_save_stats setting filename to size of PATH_MAX to have enough space to also hold the player directory prefix which would otherwise create a memory corruption and crash the game
arch/sdl/jukebox.c: Make sure read_m3u won't read past the end of the buffer, causing a crash
20101109
--------

5
arch/sdl/digi_mixer_music.c
View file

@ -59,7 +59,7 @@ int mix_play_file(char *filename, int loop, void (*hook_finished_track)())
if (!current_music)
current_music = Mix_LoadMUS(filename);
// no luck. so it might be in Searchpath. So try to build absolute path
// no luck. so either it's in an archive or Searchpath
if (!current_music)
{
PHYSFSX_getRealPath(filename, full_path);
@ -68,9 +68,7 @@ int mix_play_file(char *filename, int loop, void (*hook_finished_track)())
filename = full_path; // used later for possible error reporting
}
// still nothin'? Let's open via PhysFS in case it's located inside an archive
if (!current_music)
{
filehandle = PHYSFS_openRead(filename);
if (filehandle != NULL)
{
@ -80,7 +78,6 @@ int mix_play_file(char *filename, int loop, void (*hook_finished_track)())
PHYSFS_close(filehandle);
current_music = Mix_LoadMUS_RW(rw);
}
}
if (current_music)
{

2
arch/sdl/jukebox.c
View file

@ -101,7 +101,7 @@ void read_m3u(void)
JukeboxSongs.max_buf = length + 1;
buf = JukeboxSongs.list_buf;
while (buf < JukeboxSongs.list_buf + length)
while (buf < JukeboxSongs.list_buf + length - 1)
{
while (*buf == 0 || *buf == 10 || *buf == 13) // find new line - support DOS, Unix and Mac line endings
buf++;