From 7b87c60a46c3f059c9d7fbc5afb38b4992d1251c Mon Sep 17 00:00:00 2001 From: sezero Date: Sat, 10 Mar 2018 23:20:00 +0300 Subject: [PATCH] check for inlen of at least 2 at the beginning for midi meta events. otherwise we would read beyond bounds with bad (short) midis. commit ad6d7cf88d66 was mistaken this way. --- src/internal_midi.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/internal_midi.c b/src/internal_midi.c index 98ca1e68..0a755bf4 100644 --- a/src/internal_midi.c +++ b/src/internal_midi.c @@ -2047,6 +2047,9 @@ uint32_t _WM_SetupMidiEvent(struct _mdi *mdi, uint8_t * event_data, uint32_t inp MIDI Meta Events */ uint32_t tmp_length = 0; + + if (input_length < 2) + goto shortbuf; if ((event_data[0] == 0x00) && (event_data[1] == 0x02)) { /* Sequence Number @@ -2286,7 +2289,6 @@ uint32_t _WM_SetupMidiEvent(struct _mdi *mdi, uint8_t * event_data, uint32_t inp Deal with this inside calling function We only setting this up here for _WM_Event2Midi function */ - if (input_length < 2) goto shortbuf; _WM_midi_setup_endoftrack(mdi); ret_cnt += 2; } else if ((event_data[0] == 0x51) && (event_data[1] == 0x03)) {