1. 23 Sep, 2008 33 commits
  2. 17 Sep, 2008 2 commits
    • Max Kellermann's avatar
      mp3: fix buffer overflow when max_frames is too large · 913028a7
      Max Kellermann authored
      The function decodeFirstFrame() allocates memory based on data from
      the mp3 header.  This can make the buffer size allocation overflow, or
      lead to a DoS attack with a very large buffer.  Cap this buffer at 8
      million frames, which should really be enough for reasonable files.
      913028a7
    • Max Kellermann's avatar
      client: check expired after client_process_line() · ef0e2fdc
      Max Kellermann authored
      The assertion on "!client_is_expired(client)" was wrong, because
      writing the command response may cause the client to become expired.
      Replace that assertion with a check.
      ef0e2fdc
  3. 12 Sep, 2008 5 commits
    • Terry's avatar
      mp4: fix potential integer overflow bug in the mp4_decode() function · 79a14c9a
      Terry authored
      A crafted mp4 file could cause an integer overflow in mp4_decode
      function in src/inputPlugins/mp4_plugin.c.  mp4ff_num_samples()
      function returns some tainted value. sizeof(float) * numSamples is an
      integer overflow operation if numSamples is too huge, so xmalloc will
      allocate a small memory region.  I constructe a mp4 file, and use
      faad2 to open the file. mp4ff_num_samples() returns -1. So I think mpd
      bears from the same problem.
      79a14c9a
    • Max Kellermann's avatar
      shout: don't write empty buffers · 89c8b19a
      Max Kellermann authored
      Add a check to write_page() which checks if there is actually data.
      Don't bother to call shout_send() if there is not.
      89c8b19a
    • Max Kellermann's avatar
      shout: removed clear_shout_buffer() · 42f61771
      Max Kellermann authored
      The function is trivial, without a benefit.  Also don't initialize
      buf.data[0], this is not a null terminated string.
      42f61771
    • Max Kellermann's avatar
      shout: make the shout_buffer static · 265b8fff
      Max Kellermann authored
      Since the buffer size is known at compile time, we can save an
      indirection by declaring it as a char array instead of a pointer.
      That saves an extra allocation, and we can calculate with the
      compile-time constant sizeof(data) instead of the attribute "max_len".
      265b8fff
    • Max Kellermann's avatar
      shout: constant plugin declarations · ebd19499
      Max Kellermann authored
      Declare both shout plugins "const", since they will never change, once
      initialized at compile time.
      ebd19499