Skip to content
GitLab
Menu
Projects
Groups
Snippets
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Sign in / Register
Toggle navigation
Menu
Open sidebar
VideoLAN
libbdplus
Commits
50e47aeb
Commit
50e47aeb
authored
Jan 08, 2015
by
anonymous
Browse files
Fix use after free
parent
c90b6bb8
Changes
1
Hide whitespace changes
Inline
Side-by-side
src/libbdplus/bdsvm/trap.c
View file @
50e47aeb
...
...
@@ -1179,18 +1179,18 @@ uint32_t TRAP_LoadContentCode(const char *device_path, uint8_t *FileName, uint32
fd
=
fopen
((
char
*
)
fname
,
"rb"
);
X_FREE
(
fname
);
if
(
!
fd
)
{
DEBUG
(
DBG_BDPLUS
|
DBG_CRIT
,
"[TRAP] ERROR: cant open %s
\n
"
,
(
char
*
)
fn
ame
);
DEBUG
(
DBG_BDPLUS
|
DBG_CRIT
,
"[TRAP] ERROR: cant open %s
\n
"
,
(
char
*
)
FileN
ame
);
return
STATUS_INVALID_PARAMETER
;
// FIXME
}
// Skip the SVM header.
if
(
fseek
(
fd
,
SVM_HEADER_SIZE
,
SEEK_SET
)
<
0
)
{
DEBUG
(
DBG_BDPLUS
|
DBG_CRIT
,
"[TRAP] ERROR: seeking %s (header) failed
\n
"
,
(
char
*
)
fn
ame
);
DEBUG
(
DBG_BDPLUS
|
DBG_CRIT
,
"[TRAP] ERROR: seeking %s (header) failed
\n
"
,
(
char
*
)
FileN
ame
);
fclose
(
fd
);
return
STATUS_INVALID_PARAMETER
;
}
if
(
fseek
(
fd
,
Section
*
0x200000
,
SEEK_CUR
)
<
0
)
{
// locate wanted section
DEBUG
(
DBG_BDPLUS
|
DBG_CRIT
,
"[TRAP] ERROR: seeking %s to section %d failed
\n
"
,
(
char
*
)
fn
ame
,
Section
);
DEBUG
(
DBG_BDPLUS
|
DBG_CRIT
,
"[TRAP] ERROR: seeking %s to section %d failed
\n
"
,
(
char
*
)
FileN
ame
,
Section
);
fclose
(
fd
);
return
STATUS_INVALID_PARAMETER
;
}
...
...
@@ -1200,7 +1200,7 @@ uint32_t TRAP_LoadContentCode(const char *device_path, uint8_t *FileName, uint32
DEBUG
(
DBG_BDPLUS
,
"[TRAP] reading %d/%08X bytes into %p
\n
"
,
*
len
,
*
len
,
dst
);
rbytes
=
fread
(
dst
,
1
,
*
len
,
fd
);
if
(
rbytes
<
0
||
rbytes
!=
(
int64_t
)
*
len
)
{
DEBUG
(
DBG_BDPLUS
|
DBG_CRIT
,
"[TRAP] ERROR: read %"
PRId64
" bytes of %d from %s
\n
"
,
rbytes
,
*
len
,
(
char
*
)
fn
ame
);
DEBUG
(
DBG_BDPLUS
|
DBG_CRIT
,
"[TRAP] ERROR: read %"
PRId64
" bytes of %d from %s
\n
"
,
rbytes
,
*
len
,
(
char
*
)
FileN
ame
);
fclose
(
fd
);
return
STATUS_INVALID_PARAMETER
;
}
...
...
Write
Preview
Supports
Markdown
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment