libFLAC: More comment validation
When the allocation for obj->comment fails, set obj->num_comments
to zero.
Patch-from: lvqcl <lvqcl.mail@gmail.com>
diff --git a/src/libFLAC/metadata_object.c b/src/libFLAC/metadata_object.c
index a799bf8..82abe41 100644
--- a/src/libFLAC/metadata_object.c
+++ b/src/libFLAC/metadata_object.c
@@ -574,6 +574,7 @@
FLAC__ASSERT(0 != object->data.vorbis_comment.comments);
to->data.vorbis_comment.comments = vorbiscomment_entry_array_copy_(object->data.vorbis_comment.comments, object->data.vorbis_comment.num_comments);
if(0 == to->data.vorbis_comment.comments) {
+ to->data.vorbis_comment.num_comments = 0;
FLAC__metadata_object_delete(to);
return 0;
}
@@ -1195,8 +1196,10 @@
free(object->data.vorbis_comment.comments);
object->data.vorbis_comment.comments = 0;
}
- else if(0 == (object->data.vorbis_comment.comments = realloc(object->data.vorbis_comment.comments, new_size)))
+ else if(0 == (object->data.vorbis_comment.comments = realloc(object->data.vorbis_comment.comments, new_size))) {
+ object->data.vorbis_comment.num_comments = 0;
return false;
+ }
/* if growing, zero all the length/pointers of new elements */
if(new_size > old_size)