After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 778206 - tracker-extract: Clarify untrusted value checks
tracker-extract: Clarify untrusted value checks
Status: RESOLVED FIXED
Product: tracker
Classification: Core
Component: Extractor
unspecified
Other All
: Normal normal
: ---
Assigned To: tracker-extractor
tracker-extractor
Depends on:
Blocks:
 
 
Reported: 2017-02-05 15:14 UTC by Philip Withnall
Modified: 2017-02-06 15:23 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
tracker-extract: Clarify a magic number (898 bytes, patch)
2017-02-05 15:14 UTC, Philip Withnall 		committed Details | Review
tracker-extract: Clarify untrusted value checks (1.66 KB, patch)
2017-02-05 15:14 UTC, Philip Withnall 		committed Details | Review

Description Philip Withnall 2017-02-05 15:14:26 UTC 
Rework some of the checks for lengths read from MP3 files to ensure that the intermediate values can’t overflow.
Comment 1 Philip Withnall 2017-02-05 15:14:30 UTC 
Created attachment 344975 [details] [review]
tracker-extract: Clarify a magic number

Looks like this is the value of the header and frame sizes.
Comment 2 Philip Withnall 2017-02-05 15:14:35 UTC 
Created attachment 344976 [details] [review]
tracker-extract: Clarify untrusted value checks

When validating the values of csize and tsize (as they are read from a
potentially untrusted MP3 file), put them as the left-hand operand in
the comparison by themselves, without adding anything which:
 • confuses Coverity;
 • potentially overflows.

Coverity ID: 1399652
Comment 3 Carlos Garnacho 2017-02-06 15:16:33 UTC 
Comment on attachment 344975 [details] [review]
tracker-extract: Clarify a magic number

that's indeed more readable :)
Comment 4 Carlos Garnacho 2017-02-06 15:16:51 UTC 
Comment on attachment 344976 [details] [review]
tracker-extract: Clarify untrusted value checks

Looks good!
Comment 5 Philip Withnall 2017-02-06 15:23:01 UTC 
Attachment 344975 [details] pushed as 35c7398 - tracker-extract: Clarify a magic number
Attachment 344976 [details] pushed as 397883a - tracker-extract: Clarify untrusted value checks