From 79c9a765581a365fa14edeba6d6a9e94ddfa64d6 Mon Sep 17 00:00:00 2001 From: chengyj1985 Date: Tue, 30 Jun 2020 14:12:32 +0800 Subject: [PATCH] Buffer 'gPi->TrackInfo' accessed by index 'sdTr' can overflow Change-Id: I24dc045f8439c5ea64caadd327d3ba67f7a7d057 --- formats/ffmpeg/mm_file_format_midi.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/formats/ffmpeg/mm_file_format_midi.c b/formats/ffmpeg/mm_file_format_midi.c index 6021ce7..74a91a0 100755 --- a/formats/ffmpeg/mm_file_format_midi.c +++ b/formats/ffmpeg/mm_file_format_midi.c @@ -415,6 +415,12 @@ static long __AvGetSizeOfFileInfo(void) if (!__AvMidGetLeastTimeTrack(&sdTr)) break; } + + if (sdTr >= MAX_SMF_TRACKS) { + debug_error(DEBUG, "__AvGetSizeOfFileInfo: Num of tracks is over MAX track number. !!\n"); + return -1; + } + pMt = &(gPi->TrackInfo[sdTr]); dTime = pMt->sdTicks - sdTotalTicks; @@ -631,10 +637,6 @@ static long __AvGetSizeOfFileInfo(void) } } - if (sdTr >= MAX_SMF_TRACKS) { - debug_error(DEBUG, "__AvGetSizeOfFileInfo: Num of tracks is over MAX track number. !!\n"); - return -1; - } __AvMidUpdateTrackTime(sdTr); if (dSetup == 0x0F) { -- 2.34.1