| commit | 8a0272b8ebe3c825b6b53b53afac4c5e51a75995 | |
| author | Filip Roséen <filip@atch.se> | |
| Wed, 1 Mar 2017 19:11:43 +0000 (1 20:11 +0100) | ||
| committer | Jean-Baptiste Kempf <jb@videolan.org> | |
| Mon, 6 Mar 2017 08:24:30 +0000 (6 09:24 +0100) | ||
| tree | 1fc13eff8d779edd32ac80534b86cc40674858d3 | treesnapshot (tar.gz zip) |
| parent | 705a427f75915d9951f62fa86851693dc16a73a7 | commitdiff |
input/control: INPUT_GET_SEEKPOINTS: prevent out-of-bounds reads
The previous implementation would potentially read the "element" right
after the last one in the subsequently used array (as priv->i_title
denotes the number of titles present).
These changes also include a check to make sure that var_GetInteger(
p_input, "title" ) does not result in a negative value (as such can be
used to read from outside the array, but on the other side).
Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
The previous implementation would potentially read the "element" right
after the last one in the subsequently used array (as priv->i_title
denotes the number of titles present).
These changes also include a check to make sure that var_GetInteger(
p_input, "title" ) does not result in a negative value (as such can be
used to read from outside the array, but on the other side).
Signed-off-by: Jean-Baptiste Kempf <jb@videolan.org>
| src/input/control.c | diffblobblamehistory |