Changeset 5829:09f674dfe78a in roaraudio for libroar/stream.c

Timestamp:

01/06/13 15:26:14 (11 years ago)

Author:

phi

Branch:

default

Phase:

public

Message:

fix possible buffer overflow (which can lead in stack overwrite) caused by ignoring buffer length in write-loop.

File:

• libroar/stream.c (modified) (2 diffs)

libroar/stream.c

@@ -1386 +1386 @@
 ssize_t   roar_profiles_list   (const char ** list, size_t len, size_t offset) {
  size_t i;
- int idx = 0;
+ ssize_t idx = 0;
 
  if ( list == NULL ) {
@@ -1399 +1399 @@
   return 0;
 
- for (i = offset; _libroar_aiprofiles[i].name != NULL; i++) {
+ for (i = offset; idx < len && _libroar_aiprofiles[i].name != NULL; i++) {
   list[idx++] = _libroar_aiprofiles[i].name;
  }