Skip to content

mtp: fix mishandling of huge track counts

Lyndon Brown requested to merge jnqnfe/vlc:mtp1 into master

the request made to the mtp library for the available tracks returns a linked list. a callback mechanism is additionally used for capturing the total track count.

problematically:

  • this callback receives a uint64_t track count which was then stored in an int before being used by a calloc() call to allocate enough memory to store all of the corresponding items. the truncation may thus mean that we do not allocate enough memory if faced with a huge count.
  • there was nothing to prevent the iteration of the linked list from going past the count, allowing the int based counter to wrap giving undefined behaviour.
Edited by Lyndon Brown

Merge request reports