openbsd-ports/audio/libmodplug/patches/patch-src_load_wav_cpp
jasper 4050b0b53e Security fixes for CVE-2011-291{1,2,3,4,5}
Various integer overflows and off-by-one errors in libmodplug.
2011-08-18 17:56:47 +00:00

17 lines
739 B
Plaintext

$OpenBSD: patch-src_load_wav_cpp,v 1.1 2011/08/18 17:56:48 jasper Exp $
Fix integer overflow (SA45131/A)
From upstream git: 2d4c56de314ab13e4437bd8b609f0b751066eee8
--- src/load_wav.cpp.orig Thu Aug 18 19:37:38 2011
+++ src/load_wav.cpp Thu Aug 18 19:37:57 2011
@@ -54,7 +54,7 @@ BOOL CSoundFile::ReadWav(const BYTE *lpStream, DWORD d
if ((Patterns[1] = AllocatePattern(64, 4)) == NULL) return TRUE;
UINT samplesize = (pfmt->channels * pfmt->bitspersample) >> 3;
UINT len = pdata->length, bytelen;
- if (dwMemPos + len > dwMemLength - 8) len = dwMemLength - dwMemPos - 8;
+ if (len > dwMemLength - 8 - dwMemPos) len = dwMemLength - dwMemPos - 8;
len /= samplesize;
bytelen = len;
if (pfmt->bitspersample >= 16) bytelen *= 2;