code: plan9front

Info  •  Files  •  Log

libtags: fix multiple issues found by fuzzing

--- a/sys/src/cmd/audio/libtags/flac.c

+++ b/sys/src/cmd/audio/libtags/flac.c

@@ -45,7 +45,7 @@

 			sz -= 8;

 			n = beuint(&d[4]);

 			mime = ctx->buf+20;

-			if(n >= sz || n >= ctx->bufsz-1 || ctx->read(ctx, mime, n) != n)

+			if(n >= sz || n >= ctx->bufsz-20 || ctx->read(ctx, mime, n) != n)

 				return -1;

 			sz -= n;

 			mime[n] = 0;

--- a/sys/src/cmd/audio/libtags/id3v2.c

+++ b/sys/src/cmd/audio/libtags/id3v2.c

@@ -35,7 +35,7 @@

 		for(; v[0]; v++){

 			if(v[0] == '(' && v[1] <= '9' && v[1] >= '0'){

 				int i = atoi(&v[1]);

-				if(i < Numgenre)

+				if(i >= 0 && i < Numgenre)

 					txtcb(ctx, Tgenre, k-1, id3genres[i]);

 				for(v++; v[0] && v[0] != ')'; v++);

 				v--;

--- a/sys/src/cmd/audio/libtags/m4a.c

+++ b/sys/src/cmd/audio/libtags/m4a.c

@@ -19,7 +19,7 @@

 	sz = beuint(d) - 4; /* already have 8 bytes */

 	for(;;){

-		if(ctx->seek(ctx, sz, 1) < 0)

+		if(sz < 0 || ctx->seek(ctx, sz, 1) < 0)

 			return -1;

 		if(ctx->read(ctx, d, 4) != 4) /* size */

 			break;

@@ -58,6 +58,8 @@

 					return -1;

 				sz -= 8;

 				skip = beuint(d) - 8;

+				if(skip < 0)

+					return -1;

 				if(memcmp(&d[4], "mp4a", 4) == 0){ /* audio */

 					n = 6+2 + 2+4+2 + 2+2 + 2+2 + 4; /* read a bunch at once */

--- a/sys/src/cmd/audio/libtags/opus.c

+++ b/sys/src/cmd/audio/libtags/opus.c

@@ -53,7 +53,7 @@

 			if(pgend < ctx->seek(ctx, 0, 1)+sz)

 				break;

-			if(ctx->bufsz < sz+1){

+			if(sz > ctx->bufsz-1){

 				if(ctx->seek(ctx, sz, 1) < 0)

 					return -1;

 				continue;

--- a/sys/src/cmd/audio/libtags/vorbis.c

+++ b/sys/src/cmd/audio/libtags/vorbis.c

@@ -97,7 +97,7 @@

 			if(pgend < ctx->seek(ctx, 0, 1)+sz)

 				break;

-			if(ctx->bufsz < sz+1){

+			if(sz > ctx->bufsz-1){

 				if(ctx->seek(ctx, sz, 1) < 0)

 					return -1;

 				continue;