RGBCube/serenity
1
Fork 0
mirror of https://github.com/RGBCube/serenity synced 2025-05-14 06:04:57 +00:00
Code Issues Activity Actions

LibAudio: Avoid UAF when loading WAV metadata

Browse source
This commit is contained in:
Tim Ledbetter 2024-01-17 19:39:29 +00:00 • committed by Tim Flynn
parent dc2233ef7a
commit d186582d30
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
Userland/Libraries/LibAudio/WavLoader.cpp
View file

@ -298,7 +298,8 @@ MaybeLoaderError WavLoaderPlugin::parse_header()
MaybeLoaderError WavLoaderPlugin::load_wav_info_block(Vector<RIFF::OwnedChunk> info_chunks)
{
for (auto const& chunk : info_chunks) {
auto metadata_name = chunk.id().as_ascii_string();
auto chunk_id = chunk.id();
auto metadata_name = chunk_id.as_ascii_string();
// Chunk contents are zero-terminated strings "ZSTR", so we just drop the null terminator.
StringView metadata_text { chunk.data().trim(chunk.size() - 1) };
// Note that we assume chunks to be unique, since that seems to almost always be the case.