media-libs/dumb/files/dumb-0.9.3_CVE-2006-3668.patch


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

Index: libdumb-0.9.3/src/it/itread.c
===================================================================
--- libdumb-0.9.3.orig/src/it/itread.c	2006-07-21 11:05:48.000000000 +0200
+++ libdumb-0.9.3/src/it/itread.c	2006-07-21 11:07:22.000000000 +0200
@@ -292,6 +292,11 @@
 
 	envelope->flags = dumbfile_getc(f);
 	envelope->n_nodes = dumbfile_getc(f);
+	if(envelope->n_nodes > 25) {
+		TRACE("IT error: wrong number of envelope nodes (%d)\n", envelope->n_nodes);
+		envelope->n_nodes = 0;
+		return -1;
+	}
 	envelope->loop_start = dumbfile_getc(f);
 	envelope->loop_end = dumbfile_getc(f);
 	envelope->sus_loop_start = dumbfile_getc(f);