From 735ca4068d0912990c5f900dc021733d4842599c Mon Sep 17 00:00:00 2001 From: Adrien Destugues Date: Wed, 12 Nov 2014 09:15:48 +0100 Subject: [PATCH] cdda: CID 610847: possibly uninitialized fields In two cases: * Out of memory and strdup on fName failed. Nothing would be initialized (mostly harmless: InitCheck would detect this) * There are no frames in the track: the wav header would be left uninitialized, and this would be readable from userland (bad thing, but needs a specifically crafted malicious CD to happen). --- src/add-ons/kernel/file_systems/cdda/kernel_interface.cpp | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/src/add-ons/kernel/file_systems/cdda/kernel_interface.cpp b/src/add-ons/kernel/file_systems/cdda/kernel_interface.cpp index 7d748ae364..9d825b79d8 100644 --- a/src/add-ons/kernel/file_systems/cdda/kernel_interface.cpp +++ b/src/add-ons/kernel/file_systems/cdda/kernel_interface.cpp @@ -1165,9 +1165,7 @@ Inode::Inode(Volume* volume, Inode* parent, const char* name, uint64 start, : fNext(NULL) { - fName = strdup(name); - if (fName == NULL) - return; + memset(&fWAVHeader, 0, sizeof(wav_header)); fID = volume->GetNextNodeID(); fType = type; @@ -1179,6 +1177,10 @@ Inode::Inode(Volume* volume, Inode* parent, const char* name, uint64 start, fCreationTime = fModificationTime = time(NULL); + fName = strdup(name); + if (fName == NULL) + return; + if (frames) { // initialize WAV header