[patch] streamripper-1.61.25-CVE-2006-3124

streamripper-1.61.25-CVE-2006-3124.patch (text/plain), 1.05 KB, created by Thomas Cort (RETIRED) on 2006-08-23 11:43:54 UTC

diff -urN streamripper-1.61.25.orig/lib/http.c streamripper-1.61.25/lib/http.c
--- streamripper-1.61.25.orig/lib/http.c	2006-08-23 14:30:12.000000000 -0400
+++ streamripper-1.61.25/lib/http.c	2006-08-23 14:31:20.000000000 -0400
@@ -275,7 +275,7 @@
     int rc;
     char *start;
     char versionbuf[64];
-    char stempbr[50];
+    char stempbr[MAX_ICY_STRING];
     URLINFO url_info;
     int url_path_len;
     int content_type_by_url;
@@ -394,7 +394,7 @@
     else if ((start = (char *)strstr(header, "SHOUTcast")) != NULL) {
 	strcpy(info->server, "SHOUTcast/");
 	if ((start = (char *)strstr(start, "Server/")) != NULL) {
-	    sscanf(start, "Server/%[^<]<", versionbuf);
+	    sscanf(start, "Server/%63[^<]<", versionbuf);
 	    strcat(info->server, versionbuf);
 	}
 
@@ -412,7 +412,7 @@
 	if (!info->server[0]) {
 	    strcpy(info->server, "icecast/");
 	    if ((start = (char *)strstr(start, "version ")) != NULL) {
-		sscanf(start, "version %[^<]<", versionbuf);
+		sscanf(start, "version %63[^<]<", versionbuf);
 		strcat(info->server, versionbuf);
 	    }
 	}