blob: b63c2c3285c02dece1a0f1aa68877d1560a46cc0 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
|
$NetBSD: patch-ae,v 1.2 2006/10/10 00:22:28 dmcmahill Exp $
--- src/player.c.orig 2002-12-10 14:30:26.000000000 -0500
+++ src/player.c 2006-10-09 13:31:30.464278000 -0400
@@ -44,4 +44,11 @@
#include "player/meta.h" /* Provides: record interpreters */
+#ifdef HAVE_STDINT_H
+#include <stdint.h>
+#endif
+#ifndef UINT32_MAX
+#include <limits.h>
+#endif
+
/**
* @internal
@@ -133,6 +140,12 @@
}
-/* P->Parameters = (unsigned char*) wmf_malloc (API,(MAX_REC_SIZE(API)-3) * 2 * sizeof (unsigned char));
- */ P->Parameters = (unsigned char*) wmf_malloc (API,(MAX_REC_SIZE(API) ) * 2 * sizeof (unsigned char));
+ if (MAX_REC_SIZE(API) > UINT32_MAX/ 2)
+ {
+ API->err = wmf_E_InsMem;
+ WMF_DEBUG (API,"bailing...");
+ return (API->err);
+ }
+
+ P->Parameters = (unsigned char*) wmf_malloc (API,(MAX_REC_SIZE(API) ) * 2 * sizeof (unsigned char));
if (ERR (API))
|
