Просмотр исходного кода

libobs: Fix memory overrun if libobs version mismatches

When size of source_info_t is larger then current structure, memcpy
overruns. Size check is moved before the memcpy.

HANDLE_ERROR macro copies info to data but data is not used. When
calling free_type_data and type_data, the member of data should be used
to ensure the free_type_data is not out of bounds.
Norihiro Kamae 4 лет назад
Родитель
Сommit
5e44e6412a
1 измененных файлов с 11 добавлено и 11 удалено
  1. 11 11
      libobs/obs-module.c

+ 11 - 11
libobs/obs-module.c

@@ -594,8 +594,8 @@ cleanup:
 		memcpy(&data, info,                                        \
 		       sizeof(data) < size_var ? sizeof(data) : size_var); \
                                                                            \
-		if (info->type_data && info->free_type_data)               \
-			info->free_type_data(info->type_data);             \
+		if (data.type_data && data.free_type_data)                 \
+			data.free_type_data(data.type_data);               \
 	} while (false)
 
 #define source_warn(format, ...) \
@@ -631,6 +631,15 @@ void obs_register_source_s(const struct obs_source_info *info, size_t size)
 		goto error;
 	}
 
+	if (size > sizeof(data)) {
+		source_warn("Tried to register obs_source_info with size "
+			    "%llu which is more than libobs currently "
+			    "supports (%llu)",
+			    (long long unsigned)size,
+			    (long long unsigned)sizeof(data));
+		goto error;
+	}
+
 	memcpy(&data, info, size);
 
 	/* mark audio-only filters as an async filter categorically */
@@ -684,15 +693,6 @@ void obs_register_source_s(const struct obs_source_info *info, size_t size)
 	}
 #undef CHECK_REQUIRED_VAL_
 
-	if (size > sizeof(data)) {
-		source_warn("Tried to register obs_source_info with size "
-			    "%llu which is more than libobs currently "
-			    "supports (%llu)",
-			    (long long unsigned)size,
-			    (long long unsigned)sizeof(data));
-		goto error;
-	}
-
 	/* version-related stuff */
 	data.unversioned_id = data.id;
 	if (data.version) {