mtp: fix mishandling of huge track counts
the request made to the mtp library for the available tracks returns a linked list. a callback mechanism is additionally used for capturing the total track count.
problematically:
- this callback receives a
uint64_ttrack count which was then stored in anintbefore being used by acalloc()call to allocate enough memory to store all of the corresponding items. the truncation may thus mean that we do not allocate enough memory if faced with a huge count. - there was nothing to prevent the iteration of the linked list from going
past the count, allowing the
intbased counter to wrap giving undefined behaviour.
Edited by Lyndon Brown