From 0381919e83eb891d2a76eda1dfab15b7e641fca9 Mon Sep 17 00:00:00 2001
From: Vincent Penquerc'h <vincent.penquerch@collabora.co.uk>
Date: Tue, 16 Aug 2011 10:24:37 +0100
Subject: [PATCH] aiffmux: drop data after 4ish GB and moan

https://bugzilla.gnome.org/show_bug.cgi?id=654278
---
 gst/aiff/aiffmux.c | 26 ++++++++++++++++++++++++++
 gst/aiff/aiffmux.h |  1 +
 2 files changed, 27 insertions(+)

diff --git a/gst/aiff/aiffmux.c b/gst/aiff/aiffmux.c
index e9f7aa5ebc..a2d99f587c 100644
--- a/gst/aiff/aiffmux.c
+++ b/gst/aiff/aiffmux.c
@@ -130,6 +130,7 @@ gst_aiff_mux_change_state (GstElement * element, GstStateChange transition)
       aiffmux->length = 0;
       aiffmux->rate = 0.0;
       aiffmux->sent_header = FALSE;
+      aiffmux->overflow = FALSE;
       break;
     default:
       break;
@@ -296,12 +297,16 @@ gst_aiff_mux_chain (GstPad * pad, GstBuffer * buf)
 {
   GstAiffMux *aiffmux = GST_AIFF_MUX (GST_PAD_PARENT (pad));
   GstFlowReturn flow = GST_FLOW_OK;
+  guint64 cur_size;
 
   if (!aiffmux->channels) {
     gst_buffer_unref (buf);
     return GST_FLOW_NOT_NEGOTIATED;
   }
 
+  if (G_UNLIKELY (aiffmux->overflow))
+    goto overflow;
+
   if (!aiffmux->sent_header) {
     /* use bogus size initially, we'll write the real
      * header when we get EOS and know the exact length */
@@ -316,6 +321,20 @@ gst_aiff_mux_chain (GstPad * pad, GstBuffer * buf)
     aiffmux->sent_header = TRUE;
   }
 
+  /* AIFF has an audio data size limit of slightly under 4 GB.
+     A value of audiosize + AIFF_HEADER_LEN - 8 is written, so
+     I'll error out if writing data that makes this overflow. */
+  cur_size = aiffmux->length + AIFF_HEADER_LEN - 8;
+  if (G_UNLIKELY (cur_size + GST_BUFFER_SIZE (buf) >= G_MAXUINT32)) {
+    GST_ERROR_OBJECT (aiffmux, "AIFF only supports about 4 GB worth of "
+        "audio data, dropping any further data on the floor");
+    GST_ELEMENT_WARNING (aiffmux, STREAM, MUX, ("AIFF has a 4GB size limit"),
+        ("AIFF only supports about 4 GB worth of audio data, "
+            "dropping any further data on the floor"));
+    aiffmux->overflow = TRUE;
+    goto overflow;
+  }
+
   GST_LOG_OBJECT (aiffmux, "pushing %u bytes raw audio, ts=%" GST_TIME_FORMAT,
       GST_BUFFER_SIZE (buf), GST_TIME_ARGS (GST_BUFFER_TIMESTAMP (buf)));
 
@@ -330,6 +349,13 @@ gst_aiff_mux_chain (GstPad * pad, GstBuffer * buf)
   flow = gst_pad_push (aiffmux->srcpad, buf);
 
   return flow;
+
+overflow:
+  {
+    GST_WARNING_OBJECT (aiffmux, "output file too large, dropping buffer");
+    gst_buffer_unref (buf);
+    return GST_FLOW_OK;
+  }
 }
 
 static gboolean
diff --git a/gst/aiff/aiffmux.h b/gst/aiff/aiffmux.h
index 73c1d89d3a..9c0954f589 100644
--- a/gst/aiff/aiffmux.h
+++ b/gst/aiff/aiffmux.h
@@ -81,6 +81,7 @@ struct _GstAiffMux
   gdouble rate;
 
   gboolean sent_header;
+  gboolean overflow;
 };
 
 struct _GstAiffMuxClass