Fixed possible buffer overread (#120)

CelliesProjects · web-flow · commit 15907eba3f3d · 2026-04-05T10:59:34.000+02:00
Fixes the issue discovered in #109 (comment)
diff --git a/src/ESP32_VS1053_Stream.cpp b/src/ESP32_VS1053_Stream.cpp
@@ -880,12 +880,12 @@ void ESP32_VS1053_Stream::_handleLocalFile()
 
     if (_remainingBytes && _file.position() < _file.size())
     {
-        size_t free = xRingbufferGetCurFreeSize(_ringbuffer_handle);
+        const size_t free = xRingbufferGetCurFreeSize(_ringbuffer_handle);
         if (free > 1024)
         {
-            size_t toRead = min(sizeof(_localbuffer), free);
-            size_t bytes = _file.read(_localbuffer, toRead);
-
+            const size_t toRead = min(sizeof(_localbuffer), free);
+            const size_t avail = min(toRead, (size_t)_remainingBytes);
+            const size_t bytes = _file.read(_localbuffer, avail);
             if (bytes)
             {
                 if (xRingbufferSend(_ringbuffer_handle, _localbuffer, bytes, 0) == pdFALSE)

Original file line number	Diff line number	Diff line change
`@@ -880,12 +880,12 @@ void ESP32_VS1053_Stream::_handleLocalFile()`
`880`	`880`
`881`	`881`	`if (_remainingBytes && _file.position() < _file.size())`
`882`	`882`	`{`
`883`		`- size_t free = xRingbufferGetCurFreeSize(_ringbuffer_handle);`
	`883`	`+ const size_t free = xRingbufferGetCurFreeSize(_ringbuffer_handle);`
`884`	`884`	`if (free > 1024)`
`885`	`885`	`{`
`886`		`- size_t toRead = min(sizeof(_localbuffer), free);`
`887`		`- size_t bytes = _file.read(_localbuffer, toRead);`
`888`		`-`
	`886`	`+ const size_t toRead = min(sizeof(_localbuffer), free);`
	`887`	`+ const size_t avail = min(toRead, (size_t)_remainingBytes);`
	`888`	`+ const size_t bytes = _file.read(_localbuffer, avail);`
`889`	`889`	`if (bytes)`
`890`	`890`	`{`
`891`	`891`	`if (xRingbufferSend(_ringbuffer_handle, _localbuffer, bytes, 0) == pdFALSE)`