decoder/dsdiff: fix off-by-one buffer overflow

b24cbc68 · Max Kellermann · 976fdd76 · b24cbc68 · b24cbc68
Commit b24cbc68 authored Mar 06, 2016 by Max Kellermann
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 1 deletion

NEWS NEWS +1 -0

DsdiffDecoderPlugin.cxx src/decoder/plugins/DsdiffDecoderPlugin.cxx +1 -1

No files found.
--- a/NEWS
+++ b/NEWS
 ver 0.19.14 (not yet released)
 * decoder
+  - dsdiff: fix off-by-one buffer overflow
  - opus: limit tag size to 64 kB
 * fix build failures on non-glibc builds due to constexpr Mutex


--- a/src/decoder/plugins/DsdiffDecoderPlugin.cxx
+++ b/src/decoder/plugins/DsdiffDecoderPlugin.cxx
@@ -205,7 +205,7 @@ dsdiff_handle_native_tag(InputStream &is,
 	if (length == 0 || length > 60)
 		return;

-	char string[length];
+	char string[length + 1];
 	char *label;
 	label = string;