[vlc-commits] [Git][videolan/vlc][3.0.x] 5 commits: access: cdrom: check track range
François Cartegnie (@fcartegnie)
gitlab at videolan.org
Mon Sep 14 08:44:06 UTC 2026
François Cartegnie pushed to branch 3.0.x at VideoLAN / VLC
Commits:
8792dc73 by François Cartegnie at 2026-09-14T10:26:41+02:00
access: cdrom: check track range
Do not trust firmware/ioctl
refs #29859
(adapted from commit cac7931a910f5b23c9e7aec6e79f6481d05df3a0)
- - - - -
7b40b1e9 by François Cartegnie at 2026-09-14T10:26:41+02:00
access: cdrom: fix wrong alloc size on win32
refs #29856
(adapted from commit 8041ce1f7419f3f6f60733933f0f697fdc3817bf)
- - - - -
10d87376 by François Cartegnie at 2026-09-14T10:26:41+02:00
access: cdrom: fix TOC handling on darwin
refs #29857
(adapted from commit 1ffdaa081e8e37b51d76d97c10a3063979a1ffc6)
- - - - -
5e82fb88 by François Cartegnie at 2026-09-14T10:26:41+02:00
access: vcd: set proper TOC tracks limit
(cherry picked from commit 6f19ccdac89db7718e1a07dcbdbae8c7e0408d87)
- - - - -
d27b8e94 by François Cartegnie at 2026-09-14T10:26:41+02:00
access: cdrom: add proper define for max track values
refs #29858
(cherry picked from commit f6c0d67308e27a3fb3b163d0d995d180fd014afc)
- - - - -
2 changed files:
- modules/access/vcd/cdrom.c
- modules/access/vcd/cdrom_internals.h
Changes:
=====================================
modules/access/vcd/cdrom.c
=====================================
@@ -257,6 +257,18 @@ void ioctl_Close( vlc_object_t * p_this, vcddev_t *p_vcddev )
free( p_vcddev );
}
+static bool TrackNumberIsValid( int i_number )
+{
+ return (i_number >= CD_MIN_TRACK_NO && i_number <= CD_MAX_TRACK_NO);
+}
+
+static bool TracksRangeIsValid( int i_first, int i_last )
+{
+ return TrackNumberIsValid( i_first ) &&
+ TrackNumberIsValid( i_last ) &&
+ i_last >= i_first;
+}
+
/*****************************************************************************
* ioctl_GetTOC: Read the Table of Content, fill in the p_sectors map
* if b_fill_sector_info is true.
@@ -319,7 +331,7 @@ vcddev_toc_t * ioctl_GetTOC( vlc_object_t *p_this, const vcddev_t *p_vcddev,
{
int i, i_leadout = -1;
CDTOCDescriptor *pTrackDescriptors;
- u_char track;
+ u_char track, track_index;
p_toc->p_sectors = calloc( p_toc->i_tracks + 1,
sizeof(*p_toc->p_sectors) );
@@ -332,18 +344,18 @@ vcddev_toc_t * ioctl_GetTOC( vlc_object_t *p_this, const vcddev_t *p_vcddev,
pTrackDescriptors = pTOC->descriptors;
- for( p_toc->i_tracks = 0, i = 0; i < i_descriptors; i++ )
+ for( track_index = 0, i = 0; i < i_descriptors && track_index < p_toc->i_tracks; i++ )
{
track = pTrackDescriptors[i].point;
if( track == 0xA2 )
i_leadout = i;
- if( track > CD_MAX_TRACK_NO || track < CD_MIN_TRACK_NO )
+ if( !TrackNumberIsValid( track ) )
continue;
- p_toc->p_sectors[p_toc->i_tracks].i_control = pTrackDescriptors[i].control;
- p_toc->p_sectors[p_toc->i_tracks++].i_lba =
+ p_toc->p_sectors[track_index].i_control = pTrackDescriptors[i].control;
+ p_toc->p_sectors[track_index++].i_lba =
CDConvertMSFToLBA( pTrackDescriptors[i].p );
}
@@ -356,7 +368,7 @@ vcddev_toc_t * ioctl_GetTOC( vlc_object_t *p_this, const vcddev_t *p_vcddev,
}
/* set leadout sector */
- p_toc->p_sectors[p_toc->i_tracks].i_lba =
+ p_toc->p_sectors[track_index].i_lba =
CDConvertMSFToLBA( pTrackDescriptors[i_leadout].p );
}
@@ -375,13 +387,20 @@ vcddev_toc_t * ioctl_GetTOC( vlc_object_t *p_this, const vcddev_t *p_vcddev,
return NULL;
}
+ if( !TracksRangeIsValid( cdrom_toc.FirstTrack, cdrom_toc.LastTrack ) )
+ {
+ msg_Err( p_this, "Invalid tracks range" );
+ vcddev_toc_Free( p_toc );
+ return NULL;
+ }
+
p_toc->i_tracks = cdrom_toc.LastTrack - cdrom_toc.FirstTrack + 1;
p_toc->i_first_track = cdrom_toc.FirstTrack;
p_toc->i_last_track = cdrom_toc.LastTrack;
if( b_fill_sectorinfo )
{
- p_toc->p_sectors = calloc( p_toc->i_tracks + 1, sizeof(p_toc->p_sectors) );
+ p_toc->p_sectors = calloc( p_toc->i_tracks + 1, sizeof(*p_toc->p_sectors) );
if( p_toc->p_sectors == NULL )
{
vcddev_toc_Free( p_toc );
@@ -417,6 +436,13 @@ vcddev_toc_t * ioctl_GetTOC( vlc_object_t *p_this, const vcddev_t *p_vcddev,
return 0;
}
+ if( !TracksRangeIsValid( tochdr.first_track, tochdr.last_track ) )
+ {
+ msg_Err( p_this, "Invalid tracks range" );
+ vcddev_toc_Free( p_toc );
+ return NULL;
+ }
+
p_toc->i_tracks = tochdr.last_track - tochdr.first_track + 1;
p_toc->i_first_track = tochdr.first_track;
p_toc->i_last_track = tochdr.last_track;
@@ -477,6 +503,13 @@ vcddev_toc_t * ioctl_GetTOC( vlc_object_t *p_this, const vcddev_t *p_vcddev,
return NULL;
}
+ if( !TracksRangeIsValid( tochdr.starting_track, tochdr.ending_track ) )
+ {
+ msg_Err( p_this, "Invalid tracks range" );
+ vcddev_toc_Free( p_toc );
+ return NULL;
+ }
+
p_toc->i_tracks = tochdr.ending_track - tochdr.starting_track + 1;
p_toc->i_first_track = tochdr.starting_track;
p_toc->i_last_track = tochdr.ending_track;
@@ -536,6 +569,13 @@ vcddev_toc_t * ioctl_GetTOC( vlc_object_t *p_this, const vcddev_t *p_vcddev,
return NULL;
}
+ if( !TracksRangeIsValid( tochdr.cdth_trk0, tochdr.cdth_trk1 ) )
+ {
+ msg_Err( p_this, "Invalid tracks range" );
+ vcddev_toc_Free( p_toc );
+ return NULL;
+ }
+
p_toc->i_tracks = tochdr.cdth_trk1 - tochdr.cdth_trk0 + 1;
p_toc->i_first_track = tochdr.cdth_trk0;
p_toc->i_last_track = tochdr.cdth_trk1;
@@ -914,7 +954,7 @@ static int OpenVCDImage( vlc_object_t * p_this, const char *psz_dev,
int track_subcodes = 0x00;
- while( fgets( line, 1024, cuefile ) && p_toc->i_tracks < INT_MAX-1 )
+ while( fgets( line, 1024, cuefile ) && p_toc->i_tracks < CD_TRACKS_COUNT_MAX )
{
/* look for a TRACK line */
unsigned track_num;
@@ -1124,7 +1164,7 @@ static int darwin_getNumberOfTracks( CDTOC *pTOC, int i_descriptors,
{
track = pTrackDescriptors[i].point;
- if( track > CD_MAX_TRACK_NO || track < CD_MIN_TRACK_NO )
+ if( !TrackNumberIsValid( track ) )
continue;
if( pTrackDescriptors[i].adr == 0x01 /* kCDSectorTypeCDDA */ )
=====================================
modules/access/vcd/cdrom_internals.h
=====================================
@@ -56,15 +56,17 @@ struct vcddev_s
*****************************************************************************/
#if defined( __APPLE__ )
#define darwin_freeTOC( p ) free( (void*)p )
+#endif
#define CD_MIN_TRACK_NO 01
#define CD_MAX_TRACK_NO 99
-#endif
+#define CD_TRACKS_COUNT_MAX (CD_MAX_TRACK_NO - CD_MIN_TRACK_NO + 1)
+#define CD_TRACKS_WITH_LEADOUT_COUNT_MAX (CD_TRACKS_COUNT_MAX + 1 /* Lead-out */)
#if defined( _WIN32 )
/* Win32 DeviceIoControl specifics */
#ifndef MAXIMUM_NUMBER_TRACKS
-# define MAXIMUM_NUMBER_TRACKS 100
+# define MAXIMUM_NUMBER_TRACKS CD_TRACKS_WITH_LEADOUT_COUNT_MAX
#endif
typedef struct _TRACK_DATA {
UCHAR Reserved;
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/1da0650bc4435d94638cab3016f65a4d23fa3ad4...d27b8e945342d0672cbe3674981e129ae20cb2f7
--
View it on GitLab: https://code.videolan.org/videolan/vlc/-/compare/1da0650bc4435d94638cab3016f65a4d23fa3ad4...d27b8e945342d0672cbe3674981e129ae20cb2f7
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help
More information about the vlc-commits
mailing list