diff options
author | Klaus Schmidinger <vdr@tvdr.de> | 2007-02-17 16:07:47 +0100 |
---|---|---|
committer | Klaus Schmidinger <vdr@tvdr.de> | 2007-02-17 16:07:47 +0100 |
commit | 2838e27fb9077b601a9241e0fde6fbd0c4362298 (patch) | |
tree | 15a50592bac52a47852153c8e074e8a875f31c4d | |
parent | 9809d5a7cc8d94c0b4345aadb926973a024c7d1f (diff) | |
download | vdr-2838e27fb9077b601a9241e0fde6fbd0c4362298.tar.gz vdr-2838e27fb9077b601a9241e0fde6fbd0c4362298.tar.bz2 |
Fixed a possible crash when loading an invalid XPM file
-rw-r--r-- | CONTRIBUTORS | 1 | ||||
-rw-r--r-- | HISTORY | 3 | ||||
-rw-r--r-- | osd.c | 22 |
3 files changed, 18 insertions, 8 deletions
diff --git a/CONTRIBUTORS b/CONTRIBUTORS index 551a4978..12a2819d 100644 --- a/CONTRIBUTORS +++ b/CONTRIBUTORS @@ -1695,6 +1695,7 @@ Henrik Niehaus <henrik.niehaus@gmx.de> Martin Wache <M.Wache@gmx.net> for adding a sleep in cDvbPlayer::Action() in case there is no data to send to the device, which avoids a busy loop on very fast machines + for fixing a possible crash when loading an invalid XPM file Matthias Lenk <matthias.lenk@amd.com> for reporting an out-of-bounds memory access with audio language ids @@ -5036,6 +5036,7 @@ Video Disk Recorder Revision History with open file handles when starting background commands (thanks to Reinhard Nissl). -2007-02-03: Version 1.4.5-2 +2007-02-17: Version 1.4.5-2 - Removed 'assert(0)' from cDvbSpuDecoder::setTime() (thanks to Marco Schlüßler). +- Fixed a possible crash when loading an invalid XPM file (thanks to Martin Wache). @@ -4,7 +4,7 @@ * See the main source file 'vdr.c' for copyright information and * how to reach the author. * - * $Id: osd.c 1.67 2006/02/26 14:31:31 kls Exp $ + * $Id: osd.c 1.67.1.1 2007/02/17 16:05:52 kls Exp $ */ #include "osd.h" @@ -218,14 +218,17 @@ bool cBitmap::LoadXpm(const char *FileName) int w, h, n, c; if (4 != sscanf(s, "%d %d %d %d", &w, &h, &n, &c)) { esyslog("ERROR: faulty 'values' line in XPM file '%s'", FileName); + isXpm = false; break; } lines = h + n + 1; Xpm = MALLOC(char *, lines); + memset(Xpm, 0, lines * sizeof(char*)); } char *q = strchr(s, '"'); if (!q) { esyslog("ERROR: missing quotes in XPM file '%s'", FileName); + isXpm = false; break; } *q = 0; @@ -233,16 +236,21 @@ bool cBitmap::LoadXpm(const char *FileName) Xpm[index++] = strdup(s); else { esyslog("ERROR: too many lines in XPM file '%s'", FileName); + isXpm = false; break; } } } - if (index == lines) - Result = SetXpm(Xpm); - else - esyslog("ERROR: too few lines in XPM file '%s'", FileName); - for (int i = 0; i < index; i++) - free(Xpm[i]); + if (isXpm) { + if (index == lines) + Result = SetXpm(Xpm); + else + esyslog("ERROR: too few lines in XPM file '%s'", FileName); + } + if (Xpm) { + for (int i = 0; i < index; i++) + free(Xpm[i]); + } free(Xpm); fclose(f); } |