From 5aa89bdd337f4d619bd7ec16ca8d2d03ef6a564c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Tim-Philipp=20M=C3=BCller?= <tim@centricular.net>
Date: Thu, 29 Jun 2006 11:11:50 +0000
Subject: [PATCH] gst/id3demux/gstid3demux.c: Make sure we don't return
 GST_FLOW_OK with a NULL buffer in certain cases where a read be...

Original commit message from CVS:
* gst/id3demux/gstid3demux.c: (gst_id3demux_trim_buffer),
(gst_id3demux_read_range):
Make sure we don't return GST_FLOW_OK with a NULL buffer in
certain cases where a read beyond the end of the file is
requested. Fixes #345930.
* gst/apetag/gsttagdemux.c: (gst_tag_demux_trim_buffer),
(gst_tag_demux_read_range):
Fix same issue here as well.
---
 ChangeLog                  | 12 ++++++++++++
 gst/apetag/gsttagdemux.c   | 24 +++++++++++++++---------
 gst/id3demux/gstid3demux.c | 26 ++++++++++++++++----------
 3 files changed, 43 insertions(+), 19 deletions(-)

diff --git a/ChangeLog b/ChangeLog
index 37c752d409..ceb6efa15d 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,15 @@
+2006-06-29  Tim-Philipp Müller  <tim at centricular dot net>
+
+	* gst/id3demux/gstid3demux.c: (gst_id3demux_trim_buffer),
+	(gst_id3demux_read_range):
+	  Make sure we don't return GST_FLOW_OK with a NULL buffer in
+	  certain cases where a read beyond the end of the file is
+	  requested. Fixes #345930.
+
+	* gst/apetag/gsttagdemux.c: (gst_tag_demux_trim_buffer),
+	(gst_tag_demux_read_range):
+	  Fix same issue here as well.
+
 2006-06-29  Zaheer Abbas Merali  <zaheerabbas at merali dot org>
 
 	* sys/ximage/gstximagesrc.c: (gst_ximage_src_ximage_get):
diff --git a/gst/apetag/gsttagdemux.c b/gst/apetag/gsttagdemux.c
index ef9dc8c523..a1fac5e35b 100644
--- a/gst/apetag/gsttagdemux.c
+++ b/gst/apetag/gsttagdemux.c
@@ -434,7 +434,7 @@ gst_tag_demux_trim_buffer (GstTagDemux * tagdemux, GstBuffer ** buf_ref)
 no_out_buffer:
   gst_buffer_unref (buf);
   *buf_ref = NULL;
-  return TRUE;
+  return FALSE;
 }
 
 static void
@@ -1158,26 +1158,32 @@ gst_tag_demux_read_range (GstTagDemux * demux,
   if (!gst_tag_demux_get_upstream_size (demux))
     return GST_FLOW_ERROR;
 
-  if (in_offset + length >= demux->priv->upstream_size - demux->priv->strip_end)
+  if (in_offset + length >= demux->priv->upstream_size - demux->priv->strip_end) {
+    if (in_offset + demux->priv->strip_end >= demux->priv->upstream_size)
+      return GST_FLOW_UNEXPECTED;
     in_length = demux->priv->upstream_size - demux->priv->strip_end - in_offset;
-  else
+  } else {
     in_length = length;
+  }
 
   ret = gst_pad_pull_range (demux->priv->sinkpad, in_offset, in_length, buffer);
 
   if (ret == GST_FLOW_OK && *buffer) {
     if (!gst_tag_demux_trim_buffer (demux, buffer))
-      goto error;
+      goto read_beyond_end;
   }
 
   return ret;
 
-error:
-  if (*buffer != NULL) {
-    gst_buffer_unref (buffer);
-    *buffer = NULL;
+read_beyond_end:
+  {
+    GST_DEBUG_OBJECT (demux, "attempted read beyond end of file");
+    if (*buffer != NULL) {
+      gst_buffer_unref (buffer);
+      *buffer = NULL;
+    }
+    return GST_FLOW_UNEXPECTED;
   }
-  return GST_FLOW_ERROR;
 }
 
 static GstFlowReturn
diff --git a/gst/id3demux/gstid3demux.c b/gst/id3demux/gstid3demux.c
index e03a193963..d2f215734d 100644
--- a/gst/id3demux/gstid3demux.c
+++ b/gst/id3demux/gstid3demux.c
@@ -384,7 +384,7 @@ gst_id3demux_trim_buffer (GstID3Demux * id3demux, GstBuffer ** buf_ref)
 no_out_buffer:
   gst_buffer_unref (buf);
   *buf_ref = NULL;
-  return TRUE;
+  return FALSE;
 }
 
 static GstFlowReturn
@@ -933,25 +933,31 @@ gst_id3demux_read_range (GstID3Demux * id3demux,
   if (!id3demux_get_upstream_size (id3demux))
     return GST_FLOW_ERROR;
 
-  if (in_offset + length >= id3demux->upstream_size - id3demux->strip_end)
+  if (in_offset + length >= id3demux->upstream_size - id3demux->strip_end) {
+    if (in_offset + id3demux->strip_end >= id3demux->upstream_size)
+      return GST_FLOW_UNEXPECTED;
     in_length = id3demux->upstream_size - id3demux->strip_end - in_offset;
-  else
+  } else {
     in_length = length;
+  }
 
   ret = gst_pad_pull_range (id3demux->sinkpad, in_offset, in_length, buffer);
-
   if (ret == GST_FLOW_OK && *buffer) {
     if (!gst_id3demux_trim_buffer (id3demux, buffer))
-      goto error;
+      goto read_beyond_end;
   }
 
   return ret;
-error:
-  if (*buffer != NULL) {
-    gst_buffer_unref (buffer);
-    *buffer = NULL;
+
+read_beyond_end:
+  {
+    GST_DEBUG_OBJECT (id3demux, "attempted read beyond end of file");
+    if (*buffer != NULL) {
+      gst_buffer_unref (buffer);
+      *buffer = NULL;
+    }
+    return GST_FLOW_UNEXPECTED;
   }
-  return GST_FLOW_ERROR;
 }
 
 static GstFlowReturn