[vlc-commits] [Git][videolan/vlc][master] 6 commits: access: cdrom: check track range

François Cartegnie (@fcartegnie) gitlab at videolan.org
Thu Sep 10 09:11:08 UTC 2026



François Cartegnie pushed to branch master at VideoLAN / VLC


Commits:
cac7931a by François Cartegnie at 2026-09-10T10:51:26+02:00
access: cdrom: check track range

Do not trust firmware/ioctl

refs #29859

- - - - -
8041ce1f by François Cartegnie at 2026-09-10T10:51:26+02:00
access: cdrom: fix wrong alloc size on win32

refs #29856

- - - - -
1ffdaa08 by François Cartegnie at 2026-09-10T10:51:26+02:00
access: cdrom: fix TOC handling on darwin

refs #29857

- - - - -
f1383b2f by François Cartegnie at 2026-09-10T10:51:26+02:00
access: cdrom: ensure cdtext string is always terminated

refs #29860

- - - - -
6f19ccda by François Cartegnie at 2026-09-10T10:51:26+02:00
access: vcd: set proper TOC tracks limit

- - - - -
f6c0d673 by François Cartegnie at 2026-09-10T10:51:26+02:00
access: cdrom: add proper define for max track values

refs #29858

- - - - -


2 changed files:

- modules/access/vcd/cdrom.c
- modules/access/vcd/cdrom_internals.h


Changes:

=====================================
modules/access/vcd/cdrom.c
=====================================
@@ -257,6 +257,18 @@ void ioctl_Close( vlc_object_t * p_this, vcddev_t *p_vcddev )
     free( p_vcddev );
 }
 
+static bool TrackNumberIsValid( int i_number )
+{
+    return (i_number >= CD_MIN_TRACK_NO && i_number <= CD_MAX_TRACK_NO);
+}
+
+static bool TracksRangeIsValid( int i_first, int i_last )
+{
+    return TrackNumberIsValid( i_first ) &&
+           TrackNumberIsValid( i_last ) &&
+           i_last >= i_first;
+}
+
 /*****************************************************************************
  * ioctl_GetTOC: Read the Table of Content, fill in the p_sectors map
  *               if b_fill_sector_info is true.
@@ -313,7 +325,7 @@ vcddev_toc_t * ioctl_GetTOC( vlc_object_t *p_this, const vcddev_t *p_vcddev )
 
         int i, i_leadout = -1;
         CDTOCDescriptor *pTrackDescriptors;
-        u_char track;
+        u_char track, track_index;
 
         p_toc->p_sectors = calloc( p_toc->i_tracks + 1,
                                     sizeof(*p_toc->p_sectors) );
@@ -326,18 +338,18 @@ vcddev_toc_t * ioctl_GetTOC( vlc_object_t *p_this, const vcddev_t *p_vcddev )
 
         pTrackDescriptors = pTOC->descriptors;
 
-        for( p_toc->i_tracks = 0, i = 0; i < i_descriptors; i++ )
+        for( track_index = 0, i = 0; i < i_descriptors && track_index < p_toc->i_tracks; i++ )
         {
             track = pTrackDescriptors[i].point;
 
             if( track == 0xA2 )
                 i_leadout = i;
 
-            if( track > CD_MAX_TRACK_NO || track < CD_MIN_TRACK_NO )
+            if( !TrackNumberIsValid( track ) )
                 continue;
 
-            p_toc->p_sectors[p_toc->i_tracks].i_control = pTrackDescriptors[i].control;
-            p_toc->p_sectors[p_toc->i_tracks++].i_lba =
+            p_toc->p_sectors[track_index].i_control = pTrackDescriptors[i].control;
+            p_toc->p_sectors[track_index++].i_lba =
                 CDConvertMSFToLBA( pTrackDescriptors[i].p );
         }
 
@@ -350,7 +362,7 @@ vcddev_toc_t * ioctl_GetTOC( vlc_object_t *p_this, const vcddev_t *p_vcddev )
         }
 
         /* set leadout sector */
-        p_toc->p_sectors[p_toc->i_tracks].i_lba =
+        p_toc->p_sectors[track_index].i_lba =
             CDConvertMSFToLBA( pTrackDescriptors[i_leadout].p );
 
         darwin_freeTOC( pTOC );
@@ -369,6 +381,13 @@ vcddev_toc_t * ioctl_GetTOC( vlc_object_t *p_this, const vcddev_t *p_vcddev )
             return NULL;
         }
 
+        if( !TracksRangeIsValid( cdrom_toc.FirstTrack, cdrom_toc.LastTrack ) )
+        {
+            msg_Err( p_this, "Invalid tracks range" );
+            vcddev_toc_Free( p_toc );
+            return NULL;
+        }
+
         p_toc->i_tracks = cdrom_toc.LastTrack - cdrom_toc.FirstTrack + 1;
         p_toc->i_first_track = cdrom_toc.FirstTrack;
         p_toc->i_last_track = cdrom_toc.LastTrack;
@@ -376,7 +395,7 @@ vcddev_toc_t * ioctl_GetTOC( vlc_object_t *p_this, const vcddev_t *p_vcddev )
         if ( cdrom_toc.TrackData[p_toc->i_tracks].TrackNumber != 0xAA )
             msg_Warn(p_this, "leadout not read properly");
 
-        p_toc->p_sectors = calloc( p_toc->i_tracks + 1, sizeof(p_toc->p_sectors) );
+        p_toc->p_sectors = calloc( p_toc->i_tracks + 1, sizeof(*p_toc->p_sectors) );
         if( p_toc->p_sectors == NULL )
         {
             vcddev_toc_Free( p_toc );
@@ -412,6 +431,13 @@ vcddev_toc_t * ioctl_GetTOC( vlc_object_t *p_this, const vcddev_t *p_vcddev )
             return NULL;
         }
 
+        if( !TracksRangeIsValid( tochdr.first_track, tochdr.last_track ) )
+        {
+            msg_Err( p_this, "Invalid tracks range" );
+            vcddev_toc_Free( p_toc );
+            return NULL;
+        }
+
         p_toc->i_tracks = tochdr.last_track - tochdr.first_track + 1;
         p_toc->i_first_track = tochdr.first_track;
         p_toc->i_last_track = tochdr.last_track;
@@ -469,6 +495,13 @@ vcddev_toc_t * ioctl_GetTOC( vlc_object_t *p_this, const vcddev_t *p_vcddev )
             return NULL;
         }
 
+        if( !TracksRangeIsValid( tochdr.starting_track, tochdr.ending_track ) )
+        {
+            msg_Err( p_this, "Invalid tracks range" );
+            vcddev_toc_Free( p_toc );
+            return NULL;
+        }
+
         p_toc->i_tracks = tochdr.ending_track - tochdr.starting_track + 1;
         p_toc->i_first_track = tochdr.starting_track;
         p_toc->i_last_track = tochdr.ending_track;
@@ -526,6 +559,13 @@ vcddev_toc_t * ioctl_GetTOC( vlc_object_t *p_this, const vcddev_t *p_vcddev )
             return NULL;
         }
 
+        if( !TracksRangeIsValid( tochdr.cdth_trk0, tochdr.cdth_trk1 ) )
+        {
+            msg_Err( p_this, "Invalid tracks range" );
+            vcddev_toc_Free( p_toc );
+            return NULL;
+        }
+
         p_toc->i_tracks = tochdr.cdth_trk1 - tochdr.cdth_trk0 + 1;
         p_toc->i_first_track = tochdr.cdth_trk0;
         p_toc->i_last_track = tochdr.cdth_trk1;
@@ -901,7 +941,7 @@ static int OpenVCDImage( vlc_object_t * p_this, const char *psz_dev,
 
     int track_subcodes = CD_ROM_SUBCODE_NONE;
 
-    while( fgets( line, 1024, cuefile ) && p_toc->i_tracks < INT_MAX-1 )
+    while( fgets( line, 1024, cuefile ) && p_toc->i_tracks < CD_TRACKS_COUNT_MAX )
     {
         /* look for a TRACK line */
         unsigned track_num;
@@ -1110,7 +1150,7 @@ static int darwin_getNumberOfTracks( CDTOC *pTOC, int i_descriptors,
     {
         track = pTrackDescriptors[i].point;
 
-        if( track > CD_MAX_TRACK_NO || track < CD_MIN_TRACK_NO )
+        if( !TrackNumberIsValid( track ) )
             continue;
 
         if( pTrackDescriptors[i].adr == 0x01 /* kCDSectorTypeCDDA */ )
@@ -1333,7 +1373,7 @@ static void CdTextParsePackText( const uint8_t *p_pack,
             *pi_repeatbuffer && !*pi_textbuffer )
         {
             *pi_textbuffer = *pi_repeatbuffer;
-            textbuffer[*pi_textbuffer] = 0;
+            textbuffer[*pi_textbuffer] = '\0';
         }
         else
         {
@@ -1343,6 +1383,7 @@ static void CdTextParsePackText( const uint8_t *p_pack,
                 i_append = CDTEXT_TEXT_BUFFER - *pi_textbuffer;
             memcpy( &textbuffer[*pi_textbuffer], p_readpos, i_append );
             *pi_textbuffer += i_append;
+            textbuffer[*pi_textbuffer] = '\0';
             *pi_repeatbuffer = 0;
         }
 
@@ -1421,7 +1462,7 @@ static int CdTextParse( vlc_meta_t ***ppp_tracks, int *pi_tracks,
     else e_textpackcharset = CDTEXT_CHARSET_ASCII7BIT;
 
     /* capture buffer */
-    char textbuffer[CDTEXT_TEXT_BUFFER];
+    char textbuffer[CDTEXT_TEXT_BUFFER+1];
     size_t i_textbuffer = 0;
     size_t i_repeatbuffer = 0;
     cd_text_pack_type i_prev_pack_type = cd_text_meta_invalid;


=====================================
modules/access/vcd/cdrom_internals.h
=====================================
@@ -55,15 +55,17 @@ struct vcddev_s
  *****************************************************************************/
 #if defined( __APPLE__ )
 #define darwin_freeTOC( p ) free( (void*)p )
+#endif
 #define CD_MIN_TRACK_NO 01
 #define CD_MAX_TRACK_NO 99
-#endif
+#define CD_TRACKS_COUNT_MAX (CD_MAX_TRACK_NO - CD_MIN_TRACK_NO + 1)
+#define CD_TRACKS_WITH_LEADOUT_COUNT_MAX (CD_TRACKS_COUNT_MAX + 1 /* Lead-out */)
 
 #if defined( _WIN32 )
 
 /* Win32 DeviceIoControl specifics */
 #ifndef MAXIMUM_NUMBER_TRACKS
-#    define MAXIMUM_NUMBER_TRACKS 100
+#    define MAXIMUM_NUMBER_TRACKS CD_TRACKS_WITH_LEADOUT_COUNT_MAX
 #endif
 typedef struct _TRACK_DATA {
     UCHAR Reserved;



View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/2b3207390f7c4cc891b5c1cf5da4ba781ea05258...f6c0d67308e27a3fb3b163d0d995d180fd014afc

-- 
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/2b3207390f7c4cc891b5c1cf5da4ba781ea05258...f6c0d67308e27a3fb3b163d0d995d180fd014afc
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help




More information about the vlc-commits mailing list