ports/multimedia/mplayer/files/patch-cddb-CVE-2007-2948
Martin Wilke acc95a7d52 - Fix cddb stack overflow
- Bump PORTREVISION

Approved by:	so (simon)
Security:	http://www.vuxml.org/freebsd/3ac80dd2-14df-11dc-bcfc-0016179b2dd5.html
2007-06-07 08:46:02 +00:00

31 lines
1.3 KiB
Text

Index: stream/stream_cddb.c
===================================================================
--- stream/stream_cddb.c (revision 20381)
+++ stream/stream_cddb.c (working copy)
@@ -435,7 +435,7 @@
switch(status) {
case 210:
- ret = sscanf( http_hdr->body, "%d %s %08lx", &status, category, &disc_id);
+ ret = sscanf( http_hdr->body, "%d %99s %08lx", &status, category, &disc_id);
if( ret!=3 ) {
mp_msg(MSGT_DEMUX, MSGL_ERR, MSGTR_ParseError);
return -1;
@@ -496,7 +496,7 @@
ptr++;
// We have a list of exact/inexact matches, so which one do we use?
// So let's take the first one.
- ret = sscanf(ptr, "%s %08lx %s", cddb_data->category, &(cddb_data->disc_id), album_title);
+ ret = sscanf(ptr, "%99s %08lx %99s", cddb_data->category, &(cddb_data->disc_id), album_title);
if( ret!=3 ) {
mp_msg(MSGT_DEMUX, MSGL_ERR, MSGTR_ParseError);
return -1;
@@ -533,7 +533,7 @@
switch(status) {
case 200:
// Found exact match
- ret = sscanf(http_hdr->body, "%d %s %08lx %s", &status, cddb_data->category, &(cddb_data->disc_id), album_title);
+ ret = sscanf(http_hdr->body, "%d %99s %08lx %99s", &status, cddb_data->category, &(cddb_data->disc_id), album_title);
if( ret!=4 ) {
mp_msg(MSGT_DEMUX, MSGL_ERR, MSGTR_ParseError);
return -1;