From b93c4068519e564ea0a94277dad1277b303f5fdb Mon Sep 17 00:00:00 2001 From: Erik de Castro Lopo Date: Wed, 17 Dec 2014 19:02:26 +1100 Subject: src/libFLAC/stream_decoder.c : Fix NULL de-reference. NULL de-reference can really only happen on a malformed file. Found using afl (http://lcamtuf.coredump.cx/afl/). Bug: 27211885 Change-Id: Iad7ced634d417df475050c8f379e0e95ec36b115 --- libFLAC/stream_decoder.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/libFLAC/stream_decoder.c b/libFLAC/stream_decoder.c index 7dff737..601d86f 100644 --- a/libFLAC/stream_decoder.c +++ b/libFLAC/stream_decoder.c @@ -1754,8 +1754,10 @@ FLAC__bool read_metadata_vorbiscomment_(FLAC__StreamDecoder *decoder, FLAC__Stre } else length -= 4; - if (!FLAC__bitreader_read_uint32_little_endian(decoder->private_->input, &obj->comments[i].length)) + if (!FLAC__bitreader_read_uint32_little_endian(decoder->private_->input, &obj->comments[i].length)) { + obj->num_comments = i; return false; /* read_callback_ sets the state for us */ + } if (obj->comments[i].length > 0) { if (length < obj->comments[i].length) { obj->num_comments = i; -- cgit v1.2.3