[libbluray-devel] mpls_dump: fix crash when parsing 1000+ playlists

[hpi1]

libbluray | branch: master | hpi1 <hpi1 at anonymous.org> | Sun May 15 15:31:38 2016 +0300| [da1ca49cfba237768669345656d936647bc40f83] | committer: hpi1

mpls_dump: fix crash when parsing 1000+ playlists

> http://git.videolan.org/gitweb.cgi/libbluray.git/?a=commit;h=da1ca49cfba237768669345656d936647bc40f83
---

 src/devtools/mpls_dump.c |    6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/src/devtools/mpls_dump.c b/src/devtools/mpls_dump.c
index 3642013..de7da0e 100644
--- a/src/devtools/mpls_dump.c
+++ b/src/devtools/mpls_dump.c
@@ -768,7 +768,7 @@ main(int argc, char *argv[])
                 dirlist[jj++] = strcpy((char*)malloc(strlen(ent->d_name)), ent->d_name);
             }
             qsort(dirlist, jj, sizeof(char*), _qsort_str_cmp);
-            for (jj = 0; dirlist[jj] != NULL; jj++) {
+            for (jj = 0; dirlist[jj] != NULL && pl_ii < 1000; jj++) {
                 char *name = NULL;
                 name = _mk_path(path, dirlist[jj]);
                 free(dirlist[jj]);
@@ -796,7 +796,11 @@ main(int argc, char *argv[])
                 pl_list[pl_ii++] = pl;
             }
         }
+        if (pl_ii >= 999) {
+            fprintf(stderr, "Error: too many play lists given. Output is truncated.\n");
+        }
     }
+
     // Cleanup
     for (ii = 0; ii < pl_ii; ii++) {
         bd_free_mpls(pl_list[ii]);