diff options
| author | Darren Salt <linux@youmustbejoking.demon.co.uk> | 2009-01-05 14:50:58 +0000 |
|---|---|---|
| committer | Darren Salt <linux@youmustbejoking.demon.co.uk> | 2009-01-05 14:50:58 +0000 |
| commit | 5347abe5764b0a0ff3ef1d357ce9934a425758fa (patch) | |
| tree | 16114922f1fe3862535ef1898da393648522d48b /src/input/input_smb.c | |
| parent | 0907a74b5fa7b8b439f1f8f5db239c7586bfb12d (diff) | |
| parent | 8f725b5644ac910294fbe28929ddc98cd1d2ad38 (diff) | |
| download | xine-lib-5347abe5764b0a0ff3ef1d357ce9934a425758fa.tar.gz xine-lib-5347abe5764b0a0ff3ef1d357ce9934a425758fa.tar.bz2 | |
Merge security fixes.
Diffstat (limited to 'src/input/input_smb.c')
| -rw-r--r-- | src/input/input_smb.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/src/input/input_smb.c b/src/input/input_smb.c index 3d495f04e..4d7e9a94a 100644 --- a/src/input/input_smb.c +++ b/src/input/input_smb.c @@ -69,6 +69,8 @@ smb_plugin_read (input_plugin_t *this_gen, char *buf, off_t len) smb_input_t *this = (smb_input_t *) this_gen; off_t n, num_bytes; + if (len < 0) + return -1; num_bytes = 0; while (num_bytes < len) @@ -89,6 +91,11 @@ smb_plugin_read_block (input_plugin_t *this_gen, fifo_buffer_t *fifo, off_t total_bytes; buf_element_t *buf = fifo->buffer_pool_alloc (fifo); + if (todo < 0 || todo > buf->size) { + buf->free_buffer (buf); + return NULL; + } + buf->content = buf->mem; buf->type = BUF_DEMUX_BLOCK; |