vgmrips / vgmplay-legacy

VGM file command-line player and Winamp plugin.
http://vgmrips.net
221 stars 52 forks source link

Fix heap overflow in VGMPlayUI #53

Closed tatokis closed 5 years ago

tatokis commented 5 years ago

On Linux, "readlink() does not append a null byte to buf" READLINK(2) which means that strrchr on VGMPlayUI.c:331 will consistently attempt to read past the buffer, as long as the memory pointed to hasn't been zeroed out by something else in the past, before it was allocated.

GetModuleFileName on Windows XP, if the length of the path exceeds nSize, then "The string is truncated to nSize characters and is not null-terminated." https://docs.microsoft.com/en-us/windows/desktop/api/libloaderapi/nf-libloaderapi-getmodulefilenamea

This commit fixes the issue by using calloc to zero out the string, and then lowering the size value by one, so that on linux the string is always terminated, and on Windows XP it will still be terminated even if it gets truncated.