mtp: fix mishandling of huge track counts
the request made to the mtp library for the available tracks returns a linked list. a callback mechanism is additionally used for capturing the total track count.
problematically:
- this callback receives a
uint64_t
track count which was then stored in anint
before being used by acalloc()
call to allocate enough memory to store all of the corresponding items. the truncation may thus mean that we do not allocate enough memory if faced with a huge count. - there was nothing to prevent the iteration of the linked list from going
past the count, allowing the
int
based counter to wrap giving undefined behaviour.
Edited by Lyndon Brown