From 081f024e2cc55732108afa8d9569fe8edf72b9ba Mon Sep 17 00:00:00 2001 From: Thulinma Date: Tue, 17 May 2016 10:17:32 +0200 Subject: [PATCH] Fix segfault in DTSC library when walking out of an incomplete object. --- lib/dtscmeta.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/lib/dtscmeta.cpp b/lib/dtscmeta.cpp index 1a548f68..805e0ffa 100644 --- a/lib/dtscmeta.cpp +++ b/lib/dtscmeta.cpp @@ -278,7 +278,7 @@ namespace DTSC { if (p[0] == DTSC_OBJ || p[0] == DTSC_CON) { p++; //object, scan contents - while (p[0] + p[1] != 0 && p < max) { //while not encountering 0x0000 (we assume 0x0000EE) + while (p < max && p[0] + p[1] != 0) { //while not encountering 0x0000 (we assume 0x0000EE) if (p + 2 >= max) { return 0;//out of packet! } @@ -294,7 +294,7 @@ namespace DTSC { if (p[0] == DTSC_ARR) { p++; //array, scan contents - while (p[0] + p[1] != 0 && p < max) { //while not encountering 0x0000 (we assume 0x0000EE) + while (p < max && p[0] + p[1] != 0) { //while not encountering 0x0000 (we assume 0x0000EE) //search through contents... p = skipDTSC(p, max); if (!p) {