From 3e347fd3e8e7e20afc562268f27fd3c2b79f4d0e Mon Sep 17 00:00:00 2001 From: Bastien Nocera Date: Tue, 29 Oct 2013 11:37:15 +0100 Subject: [PATCH 2/3] Avoid OOB read with buggy servers If the server doesn't start the Content-Range field with "bytes=" we would have an out-of-bounds read trying to parse the content of that field. Fall back to a 0 offset when a parsing error occurs. See https://bugzilla.redhat.com/show_bug.cgi?id=1024020 https://bugzilla.gnome.org/show_bug.cgi?id=711063 --- libdmapsharing/daap-share.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/libdmapsharing/daap-share.c b/libdmapsharing/daap-share.c index 66cdfe6..e182055 100644 --- a/libdmapsharing/daap-share.c +++ b/libdmapsharing/daap-share.c @@ -922,8 +922,13 @@ databases_items_xxx (DMAPShare * share, const gchar *s; gchar *content_range; - s = range_header + strlen ("bytes="); /* bytes= */ - offset = atoll (s); + if (!g_ascii_strncasecmp (range_header, "bytes=", strlen("bytes="))) { + /* Not starting with "bytes=" ? */ + offset = 0; + } else { + s = range_header + strlen ("bytes="); /* bytes= */ + offset = atoll (s); + } content_range = g_strdup_printf ("bytes %" G_GUINT64_FORMAT "-%" -- 1.8.3.1