blob: 169d9b55bc4a74a244a1c4dd67ef4f3dd443fc2a (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
|
$NetBSD: patch-af,v 1.1 2007/09/19 15:39:13 jlam Exp $
--- src/player.c.orig Tue Dec 10 19:30:26 2002
+++ src/player.c
@@ -43,6 +43,16 @@
#include "player/record.h" /* Provides: parameter mechanism */
#include "player/meta.h" /* Provides: record interpreters */
+#ifdef HAVE_STDINT_H
+#include <stdint.h>
+#endif
+#ifndef UINT32_MAX
+#include <limits.h>
+#endif
+#ifndef UINT32_MAX
+#define UINT32_MAX UINT_MAX
+#endif
+
/**
* @internal
*/
@@ -132,8 +142,14 @@ wmf_error_t wmf_scan (wmfAPI* API,unsign
}
}
-/* P->Parameters = (unsigned char*) wmf_malloc (API,(MAX_REC_SIZE(API)-3) * 2 * sizeof (unsigned char));
- */ P->Parameters = (unsigned char*) wmf_malloc (API,(MAX_REC_SIZE(API) ) * 2 * sizeof (unsigned char));
+ if (MAX_REC_SIZE(API) > UINT32_MAX/ 2)
+ {
+ API->err = wmf_E_InsMem;
+ WMF_DEBUG (API,"bailing...");
+ return (API->err);
+ }
+
+ P->Parameters = (unsigned char*) wmf_malloc (API,(MAX_REC_SIZE(API) ) * 2 * sizeof (unsigned char));
if (ERR (API))
{ WMF_DEBUG (API,"bailing...");
|
