← Back to branch summary

~ubuntu-branches/ubuntu/raring/libdvdread/raring-proposed

« back to all changes in this revision

Viewing changes to debian/patches/08-array.patch

  • Committer: Package Import Robot
  • Author(s): Vibhav Pant
  • Date: 2012-12-15 17:06:42 UTC
  • mfrom: (1.3.2) (3.2.15 sid)
  • Revision ID: package-import@ubuntu.com-20121215170642-q0h4cc4r2mchkgcl
Tags: 4.2.0+20121016-1ubuntu1
https://launchpad.net/bugs/1090692
* Merge from Debian unstable (LP: #1090692).  Remaining changes:
  - Re-add missing install-css.sh.
  - debian/control: add Suggests for install-css.sh on debhelper,
    fakeroot, and build-essential.
  - debian/rules: install install-css.sh, leave perms executable.

Show diffs side-by-side

added added

removed removed

Lines of Context:
debian/patches/08-array.patch
1
 
Author: Doug Springer <gpib@rickyrockrat.net>
2
 
Description:
3
 
 In the file ifo_read.c, function ifoRead_TT_SRPT, where a structure array is
4
 
 allocated, but another variable, extracted from the DVD info determines the
5
 
 lenght of the array, resulting in read/writes beyond the array. I truncate
6
 
 the read, but perhaps a better solution would be to expand the malloc to
7
 
 include the data off the DVD. I believe that, however could lead to out of
8
 
 memory errors if the DVD data was bad/invalid.
9
 
 .
10
 
 With the applied patch, dvdbackup no longer segfaults (Closes: #649790).
11
 
 
12
 
diff -Naurp libdvdread.orig/src/ifo_read.c libdvdread/src/ifo_read.c
13
 
--- libdvdread.orig/src/ifo_read.c      2012-06-29 22:38:13.234838450 +0200
14
 
+++ libdvdread/src/ifo_read.c   2012-06-29 22:43:05.753445000 +0200
15
 
@@ -1081,6 +1081,12 @@ int ifoRead_TT_SRPT(ifo_handle_t *ifofil
16
 
     return 0;
17
 
   }
18
 
 
19
 
+  if(tt_srpt->nr_of_srpts>info_length/sizeof(title_info_t)){
20
 
+    fprintf(stderr,"libdvdread: data mismatch: info_length (%ld)!= nr_of_srpts (%d). Truncating.\n",
21
 
+            info_length/sizeof(title_info_t),tt_srpt->nr_of_srpts);
22
 
+    tt_srpt->nr_of_srpts=info_length/sizeof(title_info_t);
23
 
+  }
24
 
+
25
 
   for(i =  0; i < tt_srpt->nr_of_srpts; i++) {
26
 
     B2N_16(tt_srpt->title[i].nr_of_ptts);
27
 
     B2N_16(tt_srpt->title[i].parental_id);