Autres/Rivendellaudio
1
0
Fork 0
mirror of https://github.com/ElvishArtisan/rivendell.git synced 2025-11-29 16:50:13 +01:00
Code Issues Projects Releases Wiki Activity

2018-07-23 Fred Gleason <fredg@paravelsystems.com>

Browse Source 
* Fixed a buffer overflow vulnerability in the 'RDCddbLookup' class.
This commit is contained in:
Fred Gleason
2018-07-23 16:01:50 +00:00
parent c52c9b9f8a
commit b40206b949
2 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
ChangeLog
View File

@@ -17206,3 +17206,5 @@
* Incremented the database version to 295. * Incremented the database version to 295.
* Refactored the log importer code to use the static 'IMPORTER_LINES' * Refactored the log importer code to use the static 'IMPORTER_LINES'
table. table.
2018-07-23 Fred Gleason <fredg@paravelsystems.com>
* Fixed a buffer overflow vulnerability in the 'RDCddbLookup' class.

10
lib/rdcddblookup.cpp
View File

@@ -138,7 +138,7 @@ void RDCddbLookup::readyReadData()
switch(lookup_state) { switch(lookup_state) {
case 0: // Login Banner case 0: // Login Banner
if((code==200)||(code==201)) { if((code==200)||(code==201)) {
sprintf(buffer,"cddb hello %s %s %s %s", snprintf(buffer,2048,"cddb hello %s %s %s %s",
(const char *)lookup_username, (const char *)lookup_username,
(const char *)lookup_hostname, (const char *)lookup_hostname,
(const char *)lookup_appname, (const char *)lookup_appname,
@@ -153,13 +153,13 @@ void RDCddbLookup::readyReadData()
case 1: // Handshake Response case 1: // Handshake Response
if((code==200)||(code==402)) { if((code==200)||(code==402)) {
sprintf(buffer,"cddb query %08x %d", snprintf(buffer,2048,"cddb query %08x %d",
lookup_record->discId(),lookup_record->tracks()); lookup_record->discId(),lookup_record->tracks());
for(int i=0;i<lookup_record->tracks();i++) { for(int i=0;i<lookup_record->tracks();i++) {
sprintf(offset," %d",lookup_record->trackOffset(i)); snprintf(offset,256," %d",lookup_record->trackOffset(i));
strcat(buffer,offset); strcat(buffer,offset);
} }
sprintf(offset," %d",lookup_record->discLength()/75); snprintf(offset,256," %d",lookup_record->discLength()/75);
strcat(buffer,offset); strcat(buffer,offset);
SendToServer(buffer); SendToServer(buffer);
lookup_state=2; lookup_state=2;
@@ -182,7 +182,7 @@ void RDCddbLookup::readyReadData()
start+=9; start+=9;
} }
lookup_record->setDiscTitle((const char *)line+start); lookup_record->setDiscTitle((const char *)line+start);
sprintf(buffer,"cddb read %s %08x\n", snprintf(buffer,2048,"cddb read %s %08x\n",
(const char *)lookup_record->discGenre(), (const char *)lookup_record->discGenre(),
lookup_record->discId()); lookup_record->discId());
SendToServer(buffer); SendToServer(buffer);