diff options
author | William Wilgus <me.theuser@yahoo.com> | 2018-12-13 10:39:49 -0600 |
---|---|---|
committer | William Wilgus <me.theuser@yahoo.com> | 2018-12-14 01:28:17 -0600 |
commit | 3f110daf3032187c052a6e3c1b05d01d1a4582d0 (patch) | |
tree | d2fcb43e9010dd7f5b414b68d23448dfcccd8513 /flash/bootbox | |
parent | ce0b31d87db3c4c1c1bfb535c50770d33e9c4aaf (diff) |
Fix tree.c->tree_get_entry_at() buffer overflow
I observed a crash on buflib>move_block
after dumping ram I noticed that the buffer for filetypes was being corrupted
tree_get_entry_at returns a entry from the buflib 'tree entry' buffer
filetree.c->ft_load writes data to this buffer before checking if it has
reached the last entry resulting in buffer overflow that overwrites the
next entry in the buffer ['filetypes']
Patch checks that the index passed to tree_get_entry_at() is in range
otherwise it returns NULL
Added checks + panic in other functions using tree_get_entry_at()
Fixed tree_lock_cache() calls in playlist and filetree
Change-Id: Ibf9e65652b4e00445e8e509629aebbcddffcfd4d
Diffstat (limited to 'flash/bootbox')
0 files changed, 0 insertions, 0 deletions