jp9000/obs-studio
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

libobs: Fix memory overrun if libobs version mismatches

Browse Source 
When size of source_info_t is larger then current structure, memcpy
overruns. Size check is moved before the memcpy.

HANDLE_ERROR macro copies info to data but data is not used. When
calling free_type_data and type_data, the member of data should be used
to ensure the free_type_data is not out of bounds.
This commit is contained in:
Norihiro Kamae 2021-06-15 01:24:56 +09:00 committed by Jim
parent 5485a91d4c
commit 5e44e6412a
1 changed files with 11 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
libobs/obs-module.c
View File

@ -594,8 +594,8 @@ cleanup:
memcpy(&data, info, \
sizeof(data) < size_var ? sizeof(data) : size_var); \
\
if (info->type_data && info->free_type_data) \
info->free_type_data(info->type_data); \
if (data.type_data && data.free_type_data) \
data.free_type_data(data.type_data); \
} while (false)
#define source_warn(format, ...) \
@ -631,6 +631,15 @@ void obs_register_source_s(const struct obs_source_info *info, size_t size)
goto error;
}
if (size > sizeof(data)) {
source_warn("Tried to register obs_source_info with size "
"%llu which is more than libobs currently "
"supports (%llu)",
(long long unsigned)size,
(long long unsigned)sizeof(data));
goto error;
}
memcpy(&data, info, size);
/* mark audio-only filters as an async filter categorically */
@ -684,15 +693,6 @@ void obs_register_source_s(const struct obs_source_info *info, size_t size)
}
#undef CHECK_REQUIRED_VAL_
if (size > sizeof(data)) {
source_warn("Tried to register obs_source_info with size "
"%llu which is more than libobs currently "
"supports (%llu)",
(long long unsigned)size,
(long long unsigned)sizeof(data));
goto error;
}
/* version-related stuff */
data.unversioned_id = data.id;
if (data.version) {