[vlc-commits] [Git][videolan/vlc][master] 6 commits: access: cdrom: check track range
François Cartegnie (@fcartegnie)
gitlab at videolan.org
Thu Sep 10 09:11:08 UTC 2026
François Cartegnie pushed to branch master at VideoLAN / VLC
Commits:
cac7931a by François Cartegnie at 2026-09-10T10:51:26+02:00
access: cdrom: check track range
Do not trust firmware/ioctl
refs #29859
- - - - -
8041ce1f by François Cartegnie at 2026-09-10T10:51:26+02:00
access: cdrom: fix wrong alloc size on win32
refs #29856
- - - - -
1ffdaa08 by François Cartegnie at 2026-09-10T10:51:26+02:00
access: cdrom: fix TOC handling on darwin
refs #29857
- - - - -
f1383b2f by François Cartegnie at 2026-09-10T10:51:26+02:00
access: cdrom: ensure cdtext string is always terminated
refs #29860
- - - - -
6f19ccda by François Cartegnie at 2026-09-10T10:51:26+02:00
access: vcd: set proper TOC tracks limit
- - - - -
f6c0d673 by François Cartegnie at 2026-09-10T10:51:26+02:00
access: cdrom: add proper define for max track values
refs #29858
- - - - -
2 changed files:
- modules/access/vcd/cdrom.c
- modules/access/vcd/cdrom_internals.h
Changes:
=====================================
modules/access/vcd/cdrom.c
=====================================
@@ -257,6 +257,18 @@ void ioctl_Close( vlc_object_t * p_this, vcddev_t *p_vcddev )
free( p_vcddev );
}
+static bool TrackNumberIsValid( int i_number )
+{
+ return (i_number >= CD_MIN_TRACK_NO && i_number <= CD_MAX_TRACK_NO);
+}
+
+static bool TracksRangeIsValid( int i_first, int i_last )
+{
+ return TrackNumberIsValid( i_first ) &&
+ TrackNumberIsValid( i_last ) &&
+ i_last >= i_first;
+}
+
/*****************************************************************************
* ioctl_GetTOC: Read the Table of Content, fill in the p_sectors map
* if b_fill_sector_info is true.
@@ -313,7 +325,7 @@ vcddev_toc_t * ioctl_GetTOC( vlc_object_t *p_this, const vcddev_t *p_vcddev )
int i, i_leadout = -1;
CDTOCDescriptor *pTrackDescriptors;
- u_char track;
+ u_char track, track_index;
p_toc->p_sectors = calloc( p_toc->i_tracks + 1,
sizeof(*p_toc->p_sectors) );
@@ -326,18 +338,18 @@ vcddev_toc_t * ioctl_GetTOC( vlc_object_t *p_this, const vcddev_t *p_vcddev )
pTrackDescriptors = pTOC->descriptors;
- for( p_toc->i_tracks = 0, i = 0; i < i_descriptors; i++ )
+ for( track_index = 0, i = 0; i < i_descriptors && track_index < p_toc->i_tracks; i++ )
{
track = pTrackDescriptors[i].point;
if( track == 0xA2 )
i_leadout = i;
- if( track > CD_MAX_TRACK_NO || track < CD_MIN_TRACK_NO )
+ if( !TrackNumberIsValid( track ) )
continue;
- p_toc->p_sectors[p_toc->i_tracks].i_control = pTrackDescriptors[i].control;
- p_toc->p_sectors[p_toc->i_tracks++].i_lba =
+ p_toc->p_sectors[track_index].i_control = pTrackDescriptors[i].control;
+ p_toc->p_sectors[track_index++].i_lba =
CDConvertMSFToLBA( pTrackDescriptors[i].p );
}
@@ -350,7 +362,7 @@ vcddev_toc_t * ioctl_GetTOC( vlc_object_t *p_this, const vcddev_t *p_vcddev )
}
/* set leadout sector */
- p_toc->p_sectors[p_toc->i_tracks].i_lba =
+ p_toc->p_sectors[track_index].i_lba =
CDConvertMSFToLBA( pTrackDescriptors[i_leadout].p );
darwin_freeTOC( pTOC );
@@ -369,6 +381,13 @@ vcddev_toc_t * ioctl_GetTOC( vlc_object_t *p_this, const vcddev_t *p_vcddev )
return NULL;
}
+ if( !TracksRangeIsValid( cdrom_toc.FirstTrack, cdrom_toc.LastTrack ) )
+ {
+ msg_Err( p_this, "Invalid tracks range" );
+ vcddev_toc_Free( p_toc );
+ return NULL;
+ }
+
p_toc->i_tracks = cdrom_toc.LastTrack - cdrom_toc.FirstTrack + 1;
p_toc->i_first_track = cdrom_toc.FirstTrack;
p_toc->i_last_track = cdrom_toc.LastTrack;
@@ -376,7 +395,7 @@ vcddev_toc_t * ioctl_GetTOC( vlc_object_t *p_this, const vcddev_t *p_vcddev )
if ( cdrom_toc.TrackData[p_toc->i_tracks].TrackNumber != 0xAA )
msg_Warn(p_this, "leadout not read properly");
- p_toc->p_sectors = calloc( p_toc->i_tracks + 1, sizeof(p_toc->p_sectors) );
+ p_toc->p_sectors = calloc( p_toc->i_tracks + 1, sizeof(*p_toc->p_sectors) );
if( p_toc->p_sectors == NULL )
{
vcddev_toc_Free( p_toc );
@@ -412,6 +431,13 @@ vcddev_toc_t * ioctl_GetTOC( vlc_object_t *p_this, const vcddev_t *p_vcddev )
return NULL;
}
+ if( !TracksRangeIsValid( tochdr.first_track, tochdr.last_track ) )
+ {
+ msg_Err( p_this, "Invalid tracks range" );
+ vcddev_toc_Free( p_toc );
+ return NULL;
+ }
+
p_toc->i_tracks = tochdr.last_track - tochdr.first_track + 1;
p_toc->i_first_track = tochdr.first_track;
p_toc->i_last_track = tochdr.last_track;
@@ -469,6 +495,13 @@ vcddev_toc_t * ioctl_GetTOC( vlc_object_t *p_this, const vcddev_t *p_vcddev )
return NULL;
}
+ if( !TracksRangeIsValid( tochdr.starting_track, tochdr.ending_track ) )
+ {
+ msg_Err( p_this, "Invalid tracks range" );
+ vcddev_toc_Free( p_toc );
+ return NULL;
+ }
+
p_toc->i_tracks = tochdr.ending_track - tochdr.starting_track + 1;
p_toc->i_first_track = tochdr.starting_track;
p_toc->i_last_track = tochdr.ending_track;
@@ -526,6 +559,13 @@ vcddev_toc_t * ioctl_GetTOC( vlc_object_t *p_this, const vcddev_t *p_vcddev )
return NULL;
}
+ if( !TracksRangeIsValid( tochdr.cdth_trk0, tochdr.cdth_trk1 ) )
+ {
+ msg_Err( p_this, "Invalid tracks range" );
+ vcddev_toc_Free( p_toc );
+ return NULL;
+ }
+
p_toc->i_tracks = tochdr.cdth_trk1 - tochdr.cdth_trk0 + 1;
p_toc->i_first_track = tochdr.cdth_trk0;
p_toc->i_last_track = tochdr.cdth_trk1;
@@ -901,7 +941,7 @@ static int OpenVCDImage( vlc_object_t * p_this, const char *psz_dev,
int track_subcodes = CD_ROM_SUBCODE_NONE;
- while( fgets( line, 1024, cuefile ) && p_toc->i_tracks < INT_MAX-1 )
+ while( fgets( line, 1024, cuefile ) && p_toc->i_tracks < CD_TRACKS_COUNT_MAX )
{
/* look for a TRACK line */
unsigned track_num;
@@ -1110,7 +1150,7 @@ static int darwin_getNumberOfTracks( CDTOC *pTOC, int i_descriptors,
{
track = pTrackDescriptors[i].point;
- if( track > CD_MAX_TRACK_NO || track < CD_MIN_TRACK_NO )
+ if( !TrackNumberIsValid( track ) )
continue;
if( pTrackDescriptors[i].adr == 0x01 /* kCDSectorTypeCDDA */ )
@@ -1333,7 +1373,7 @@ static void CdTextParsePackText( const uint8_t *p_pack,
*pi_repeatbuffer && !*pi_textbuffer )
{
*pi_textbuffer = *pi_repeatbuffer;
- textbuffer[*pi_textbuffer] = 0;
+ textbuffer[*pi_textbuffer] = '\0';
}
else
{
@@ -1343,6 +1383,7 @@ static void CdTextParsePackText( const uint8_t *p_pack,
i_append = CDTEXT_TEXT_BUFFER - *pi_textbuffer;
memcpy( &textbuffer[*pi_textbuffer], p_readpos, i_append );
*pi_textbuffer += i_append;
+ textbuffer[*pi_textbuffer] = '\0';
*pi_repeatbuffer = 0;
}
@@ -1421,7 +1462,7 @@ static int CdTextParse( vlc_meta_t ***ppp_tracks, int *pi_tracks,
else e_textpackcharset = CDTEXT_CHARSET_ASCII7BIT;
/* capture buffer */
- char textbuffer[CDTEXT_TEXT_BUFFER];
+ char textbuffer[CDTEXT_TEXT_BUFFER+1];
size_t i_textbuffer = 0;
size_t i_repeatbuffer = 0;
cd_text_pack_type i_prev_pack_type = cd_text_meta_invalid;
=====================================
modules/access/vcd/cdrom_internals.h
=====================================
@@ -55,15 +55,17 @@ struct vcddev_s
*****************************************************************************/
#if defined( __APPLE__ )
#define darwin_freeTOC( p ) free( (void*)p )
+#endif
#define CD_MIN_TRACK_NO 01
#define CD_MAX_TRACK_NO 99
-#endif
+#define CD_TRACKS_COUNT_MAX (CD_MAX_TRACK_NO - CD_MIN_TRACK_NO + 1)
+#define CD_TRACKS_WITH_LEADOUT_COUNT_MAX (CD_TRACKS_COUNT_MAX + 1 /* Lead-out */)
#if defined( _WIN32 )
/* Win32 DeviceIoControl specifics */
#ifndef MAXIMUM_NUMBER_TRACKS
-# define MAXIMUM_NUMBER_TRACKS 100
+# define MAXIMUM_NUMBER_TRACKS CD_TRACKS_WITH_LEADOUT_COUNT_MAX
#endif
typedef struct _TRACK_DATA {
UCHAR Reserved;
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/2b3207390f7c4cc891b5c1cf5da4ba781ea05258...f6c0d67308e27a3fb3b163d0d995d180fd014afc
--
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/2b3207390f7c4cc891b5c1cf5da4ba781ea05258...f6c0d67308e27a3fb3b163d0d995d180fd014afc
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help
More information about the vlc-commits
mailing list