On Wed, 27 Nov 2019 at 18:48, Conor McCarthy cmccarthy@codeweavers.com wrote:
+#define TAG_ICFE MAKE_TAG('I', 'C', 'F', 'E') +#define TAG_RDEF MAKE_TAG('R', 'D', 'E', 'F') +#define TAG_SFI0 MAKE_TAG('S', 'F', 'I', '0') +#define TAG_SPDB MAKE_TAG('S', 'P', 'D', 'B') +#define TAG_STAT MAKE_TAG('S', 'T', 'A', 'T')
Where do these come from? Should that be "IFCE"?
default:
TRACE("Skipping chunk %#x.\n", tag);
memcpy(tag_chars, &tag, sizeof(tag));
tag_chars[sizeof(tag)] = 0;
TRACE("Skipping chunk %s.\n", tag_chars); break;
That's not safe, "tag" can contain arbitrary data.