From a82e38d6074305cd85268476cdc50b7cdedbe9c9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= Date: Wed, 14 Jun 2017 00:09:25 +0300 Subject: [PATCH] wavparse: Actually clip to upstream size instead of size of the data chunk There might be other chunks after the data chunk, so clipping the chunk size with the data size can lead to a negative number and all following calculations go wrong and cause crashes or worse. This was introduced in 3ac119bbe2c360e28c087cf3852ea769d611b120. https://bugzilla.gnome.org/show_bug.cgi?id=783760 --- gst/wavparse/gstwavparse.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/gst/wavparse/gstwavparse.c b/gst/wavparse/gstwavparse.c index bafd4a7d6f..e2224a581b 100644 --- a/gst/wavparse/gstwavparse.c +++ b/gst/wavparse/gstwavparse.c @@ -1285,9 +1285,10 @@ gst_wavparse_stream_headers (GstWavParse * wav) } /* Clip to upstream size if known */ - if (wav->datasize > 0 && size + wav->offset > wav->datasize) { + if (upstream_size > 0 && size + wav->offset > upstream_size) { GST_WARNING_OBJECT (wav, "Clipping chunk size to file size"); - size = wav->datasize - wav->offset; + g_assert (upstream_size >= wav->offset); + size = upstream_size - wav->offset; } /* wav is a st00pid format, we don't know for sure where data starts.