RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-31 11:38:11 +00:00
Code Issues Activity Actions

LibAudio: Fix use-after-free in write_vorbis_comment

Browse source
This commit is contained in:
Karol Kosek 2023-12-05 18:14:41 +01:00 • committed by Tim Flynn
parent 4cb0593daf
commit 00e422fe1e
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
Userland/Libraries/LibAudio/VorbisComment.cpp
View file

@ -178,9 +178,9 @@ ErrorOr<void> write_vorbis_comment(Metadata const& metadata, Stream& target)
auto vorbis_user_comments = TRY(make_vorbis_user_comments(metadata)); auto vorbis_user_comments = TRY(make_vorbis_user_comments(metadata));
TRY(target.write_value<LittleEndian<u32>>(vorbis_user_comments.size())); TRY(target.write_value<LittleEndian<u32>>(vorbis_user_comments.size()));
for (auto const& field : vorbis_user_comments) { for (auto const& field : vorbis_user_comments) {
auto const serialized_field = TRY(String::formatted("{}={}", field.field_name, field.contents)).bytes(); auto const serialized_field = TRY(String::formatted("{}={}", field.field_name, field.contents));
TRY(target.write_value<LittleEndian<u32>>(serialized_field.size())); TRY(target.write_value<LittleEndian<u32>>(serialized_field.bytes().size()));
TRY(target.write_until_depleted(serialized_field)); TRY(target.write_until_depleted(serialized_field.bytes()));
} }
return {}; return {};