beenull/ladybird
1
0
Fork 0
mirror of https://github.com/LadybirdBrowser/ladybird.git synced 2024-09-29 16:21:29 +00:00
Code Issues Actions 5 Packages Projects Releases Wiki Activity

LibAudio: Fix use-after-free in write_vorbis_comment

Browse source
This commit is contained in:
Karol Kosek 2023-12-05 18:14:41 +01:00 committed by Tim Flynn
parent 4cb0593daf
commit 00e422fe1e
Notes: sideshowbarker 2024-07-16 21:51:02 +09:00 
Author: https://github.com/krkk
Commit: https://github.com/SerenityOS/serenity/commit/00e422fe1e
Pull-request: https://github.com/SerenityOS/serenity/pull/22178
1 changed files with 3 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
Userland/Libraries/LibAudio/VorbisComment.cpp
View file

@ -178,9 +178,9 @@ ErrorOr<void> write_vorbis_comment(Metadata const& metadata, Stream& target)
auto vorbis_user_comments = TRY(make_vorbis_user_comments(metadata));
TRY(target.write_value<LittleEndian<u32>>(vorbis_user_comments.size()));
for (auto const& field : vorbis_user_comments) {
auto const serialized_field = TRY(String::formatted("{}={}", field.field_name, field.contents)).bytes();
TRY(target.write_value<LittleEndian<u32>>(serialized_field.size()));
TRY(target.write_until_depleted(serialized_field));
auto const serialized_field = TRY(String::formatted("{}={}", field.field_name, field.contents));
TRY(target.write_value<LittleEndian<u32>>(serialized_field.bytes().size()));
TRY(target.write_until_depleted(serialized_field.bytes()));
}
return {};