FIx potential segfault (CID 168)
[vlc.git] / modules / misc / osd / simple.c
index 30c9bdf..d618da1 100644 (file)
@@ -1,7 +1,7 @@
 /*****************************************************************************
  * simple.c - The OSD Menu simple parser code.
  *****************************************************************************
- * Copyright (C) 2005-2007 M2X
+ * Copyright (C) 2005-2008 M2X
  * $Id$
  *
  * Authors: Jean-Paul Saman
@@ -29,7 +29,7 @@
 # include "config.h"
 #endif
 
-#include <vlc/vlc.h>
+#include <vlc_common.h>
 #include <vlc_vout.h>
 #include <vlc_config.h>
 
@@ -38,6 +38,8 @@
 #include <vlc_osd.h>
 #include <vlc_charset.h>
 
+#include <limits.h>
+
 #include "osd_menu.h"
 
 int osd_parser_simpleOpen( vlc_object_t *p_this );
@@ -51,7 +53,6 @@ int osd_parser_simpleOpen( vlc_object_t *p_this )
     osd_button_t   *p_current = NULL; /* button currently processed */
     osd_button_t   *p_prev = NULL;    /* previous processed button */
 
-#define MAX_FILE_PATH 256
     FILE       *fd = NULL;
     int        result = 0;
 
@@ -71,7 +72,7 @@ int osd_parser_simpleOpen( vlc_object_t *p_this )
     {
         char action[25] = "";
         char cmd[25] = "";
-        char path[MAX_FILE_PATH] = "";
+        char path[PATH_MAX] = "";
         char *psz_path = NULL;
         size_t i_len = 0;
         long pos = 0;
@@ -85,15 +86,18 @@ int osd_parser_simpleOpen( vlc_object_t *p_this )
             /* psz_path is not null and therefor &path[0] cannot be NULL
              * it might be null terminated.
              */
-            strncpy( &path[0], psz_path, MAX_FILE_PATH );
+            strncpy( &path[0], psz_path, PATH_MAX );
             free( psz_path );
             psz_path = NULL;
         }
         /* NULL terminate before asking the length of path[] */
-        path[MAX_FILE_PATH-1] = '\0';
+        path[PATH_MAX-1] = '\0';
         i_len = strlen(&path[0]);
-        if( i_len == MAX_FILE_PATH )
-            i_len--; /* truncate to prevent buffer overflow */
+        /* Protect against buffer overflow:
+         * max index is PATH_MAX-1 and we increment by 1 after
+         * so PATH_MAX-2 is the bigest we can have */
+        if( i_len > PATH_MAX - 2 )
+            i_len = PATH_MAX - 2;
 #if defined(WIN32) || defined(UNDER_CE)
         if( (i_len > 0) && path[i_len] != '\\' )
             path[i_len] = '\\';
@@ -114,7 +118,7 @@ int osd_parser_simpleOpen( vlc_object_t *p_this )
         /* Peek for 'style' argument */
         pos = ftell( fd );
         if( pos < 0 )
-                goto error;
+            goto error;
 
         result = fscanf(fd, "%24s %24s", &cmd[0], &action[0] );
         if( result == 0 || result == EOF )
@@ -153,7 +157,7 @@ int osd_parser_simpleOpen( vlc_object_t *p_this )
         char action[25] = "";
         char state[25]  = "";
         char file[256]  = "";
-        char path[512]  = "";
+        char path[PATH_MAX]  = "";
         int  i_x = 0;
         int  i_y = 0;
 
@@ -261,8 +265,13 @@ int osd_parser_simpleOpen( vlc_object_t *p_this )
                             size_t i_path_size = strlen( p_menu->psz_path );
                             size_t i_file_size = strlen( &file[0] );
 
+                            if( (i_path_size + i_file_size >= PATH_MAX) ||
+                                (i_path_size >= PATH_MAX) )
+                                goto error;
+
                             strncpy( &path[0], p_menu->psz_path, i_path_size );
-                            strncpy( &path[i_path_size], &file[0], 512 - (i_path_size + i_file_size) );
+                            strncpy( &path[i_path_size], &file[0],
+                                     PATH_MAX - (i_path_size + i_file_size) );
                             path[ i_path_size + i_file_size ] = '\0';
 
                             p_range_current = osd_StateNew( p_menu, &path[0], "pressed" );
@@ -270,8 +279,14 @@ int osd_parser_simpleOpen( vlc_object_t *p_this )
                         else /* absolute paths are used. */
                             p_range_current = osd_StateNew( p_menu, &file[0], "pressed" );
 
-                        if( !p_range_current || !p_range_current->p_pic )
+                        if( !p_range_current )
+                            goto error;
+
+                        if( !p_range_current->p_pic )
+                        {
+                            osd_StatesFree( p_menu, p_range_current );
                             goto error;
+                        }
 
                         p_range_current->i_x = i_x;
                         p_range_current->i_y = i_y;
@@ -360,8 +375,13 @@ int osd_parser_simpleOpen( vlc_object_t *p_this )
                         size_t i_path_size = strlen( p_menu->psz_path );
                         size_t i_file_size = strlen( &file[0] );
 
+                        if( (i_path_size + i_file_size >= PATH_MAX) ||
+                            (i_path_size >= PATH_MAX) )
+                            goto error;
+
                         strncpy( &path[0], p_menu->psz_path, i_path_size );
-                        strncpy( &path[i_path_size], &file[0], 512 - (i_path_size + i_file_size) );
+                        strncpy( &path[i_path_size], &file[0],
+                                 PATH_MAX - (i_path_size + i_file_size) );
                         path[ i_path_size + i_file_size ] = '\0';
 
                         p_range_current = osd_StateNew( p_menu, &path[0], "pressed" );
@@ -369,9 +389,15 @@ int osd_parser_simpleOpen( vlc_object_t *p_this )
                     else /* absolute paths are used. */
                         p_range_current = osd_StateNew( p_menu, &file[0], "pressed" );
 
-                    if( !p_range_current || !p_range_current->p_pic )
+                    if( !p_range_current )
                         goto error;
 
+                    if( !p_range_current->p_pic )
+                    {
+                        osd_StatesFree( p_menu, p_range_current );
+                        goto error;
+                    }
+
                     p_range_current->i_x = i_x;
                     p_range_current->i_y = i_y;
 
@@ -430,8 +456,13 @@ int osd_parser_simpleOpen( vlc_object_t *p_this )
                 size_t i_path_size = strlen( p_menu->psz_path );
                 size_t i_file_size = strlen( &file[0] );
 
+                if( (i_path_size + i_file_size >= PATH_MAX) ||
+                    (i_path_size >= PATH_MAX) )
+                    goto error;
+
                 strncpy( &path[0], p_menu->psz_path, i_path_size );
-                strncpy( &path[i_path_size], &file[0], 512 - (i_path_size + i_file_size) );
+                strncpy( &path[i_path_size], &file[0],
+                         PATH_MAX - (i_path_size + i_file_size) );
                 path[ i_path_size + i_file_size ] = '\0';
 
                 p_state_current = osd_StateNew( p_menu, &path[0], &state[0] );
@@ -439,9 +470,15 @@ int osd_parser_simpleOpen( vlc_object_t *p_this )
             else /* absolute paths are used. */
                 p_state_current = osd_StateNew( p_menu, &file[0], &state[0] );
 
-            if( !p_state_current || !p_state_current->p_pic )
+            if( !p_state_current )
                 goto error;
 
+            if( !p_state_current->p_pic )
+            {
+                osd_StatesFree( p_menu, p_state_current );
+                goto error;
+            }
+
             p_state_current->i_x = i_x;
             p_state_current->i_y = i_y;
 
@@ -471,10 +508,10 @@ int osd_parser_simpleOpen( vlc_object_t *p_this )
     fclose( fd );
     return VLC_SUCCESS;
 
-#undef MAX_FILE_PATH
 error:
     msg_Err( p_menu, "parsing file failed (returned %d)", result );
-    osd_MenuFree( p_menu );
+    if( p_menu )
+        osd_MenuFree( p_menu );
     fclose( fd );
     return VLC_EGENERIC;
 }