-
Casian Andrei authored
The total size of the buffer (i_size) was initialized with the whole allocated size for the block. This fooled block_Realloc() in the case of resizing to slightly larger, with the extra size in range from 32 to 32 + 80 bytes. block_Realloc() assumed it had enough space left in the buffer padding to avoid reallocating memory. Consequently, the block ended up with a i_buffer field with a value larger than the allocated memory around p_buffer. In the end, this could cause memory corruptions in all sorts of cases. In my case, vlc was crashing while encoutering a corrupted mp3 file. Signed-off-by:
Rémi Denis-Courmont <remi@remlab.net>
a5ebee89