1
0
mirror of https://github.com/cookiengineer/audacity synced 2025-07-16 16:47:41 +02:00

Bug 1905 - Labels with more than 260 characters fail to load (with no warning)

This commit is contained in:
James Crook 2018-08-07 11:46:21 +01:00
parent 0022e0c06c
commit 9eab948fb1
3 changed files with 12 additions and 1 deletions

View File

@ -2327,7 +2327,8 @@ bool LabelTrack::HandleXMLTag(const wxChar *tag, const wxChar **attrs)
break; break;
const wxString strValue = value; const wxString strValue = value;
if (!XMLValueChecker::IsGoodString(strValue)) // Bug 1905 was about long label strings.
if (!XMLValueChecker::IsGoodLongString(strValue))
{ {
return false; return false;
} }

View File

@ -39,6 +39,7 @@
#include "../SampleFormat.h" #include "../SampleFormat.h"
#include "../Track.h" #include "../Track.h"
// Length check. Is in part about not supplying malicious strings to file functions.
bool XMLValueChecker::IsGoodString(const wxString & str) bool XMLValueChecker::IsGoodString(const wxString & str)
{ {
size_t len = str.Length(); size_t len = str.Length();
@ -50,6 +51,13 @@ bool XMLValueChecker::IsGoodString(const wxString & str)
return false; // good place for a breakpoint return false; // good place for a breakpoint
} }
// No length check, as e.g. labels could be very long.
bool XMLValueChecker::IsGoodLongString(const wxString & str)
{
return str.Find('\0', false) == -1; // No null characters except terminator.
}
// "Good" means the name is well-formed and names an existing file or folder. // "Good" means the name is well-formed and names an existing file or folder.
bool XMLValueChecker::IsGoodFileName(const wxString & strFileName, const wxString & strDirName /* = "" */) bool XMLValueChecker::IsGoodFileName(const wxString & strFileName, const wxString & strDirName /* = "" */)
{ {

View File

@ -30,6 +30,8 @@ public:
// These are used in HandleXMLTag and BuildFomXML methods to check the input for // These are used in HandleXMLTag and BuildFomXML methods to check the input for
// security vulnerabilites, per the NGS report for UmixIt. // security vulnerabilites, per the NGS report for UmixIt.
static bool IsGoodString(const wxString & str); static bool IsGoodString(const wxString & str);
// Labels are allowed to be very long. At some future date we will format long labels nicely.
static bool IsGoodLongString(const wxString & str);
static bool IsGoodFileName(const wxString & strFileName, const wxString & strDirName = wxEmptyString); static bool IsGoodFileName(const wxString & strFileName, const wxString & strDirName = wxEmptyString);
static bool IsGoodFileString(const wxString &str); static bool IsGoodFileString(const wxString &str);