mirrors/gstreamer
mirrors/gstreamer
1
1
Fork 0
mirror of https://gitlab.freedesktop.org/gstreamer/gstreamer.git synced 2024-11-27 12:11:13 +00:00
Code Issues 1 Projects Releases Wiki Activity

wavparse: Fix parsing of adtl chunks

Browse source 
We have to skip 12 bytes of data for the chunk, and the data size
passed to the sub-chunk parsing functions should have 4 bytes less
than the data size.

Also when parsing the sub-chunks, check if we actually have enough
data to read instead of just crashing.

https://bugzilla.gnome.org/show_bug.cgi?id=736266
This commit is contained in:
Sebastian Dröge 2014-09-12 15:06:50 +03:00
parent 66810a32f6
commit a9d7c1d95e
1 changed files with 10 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
gst/wavparse/gstwavparse.c
View file

@ -889,6 +889,12 @@ gst_wavparse_adtl_chunk (GstWavParse * wav, const guint8 * data, guint32 size)
while (size >= 8) { while (size >= 8) {
ltag = GST_READ_UINT32_LE (data + offset); ltag = GST_READ_UINT32_LE (data + offset);
lsize = GST_READ_UINT32_LE (data + offset + 4); lsize = GST_READ_UINT32_LE (data + offset + 4);
if (lsize + 8 > size) {
GST_WARNING_OBJECT (wav, "Invalid adtl size: %u + 8 > %u", lsize, size);
return FALSE;
}
switch (ltag) { switch (ltag) {
case GST_RIFF_TAG_labl: case GST_RIFF_TAG_labl:
gst_wavparse_labl_chunk (wav, data + offset, size); gst_wavparse_labl_chunk (wav, data + offset, size);
@ -1470,13 +1476,14 @@ gst_wavparse_stream_headers (GstWavParse * wav)
break; break;
} }
case GST_RIFF_LIST_adtl:{ case GST_RIFF_LIST_adtl:{
const gint data_size = size; const gint data_size = size - 4;
GST_INFO_OBJECT (wav, "Have 'adtl' LIST, size %u", data_size); GST_INFO_OBJECT (wav, "Have 'adtl' LIST, size %u", data_size);
if (wav->streaming) { if (wav->streaming) {
const guint8 *data = NULL; const guint8 *data = NULL;
gst_adapter_flush (wav->adapter, 12); gst_adapter_flush (wav->adapter, 12);
wav->offset += 12;
data = gst_adapter_map (wav->adapter, data_size); data = gst_adapter_map (wav->adapter, data_size);
gst_wavparse_adtl_chunk (wav, data, data_size); gst_wavparse_adtl_chunk (wav, data, data_size);
gst_adapter_unmap (wav->adapter); gst_adapter_unmap (wav->adapter);
@ -1485,8 +1492,9 @@ gst_wavparse_stream_headers (GstWavParse * wav)
gst_buffer_unref (buf); gst_buffer_unref (buf);
buf = NULL; buf = NULL;
wav->offset += 12;
if ((res = if ((res =
gst_pad_pull_range (wav->sinkpad, wav->offset + 12, gst_pad_pull_range (wav->sinkpad, wav->offset,
data_size, &buf)) != GST_FLOW_OK) data_size, &buf)) != GST_FLOW_OK)
goto header_read_error; goto header_read_error;
gst_buffer_map (buf, &map, GST_MAP_READ); gst_buffer_map (buf, &map, GST_MAP_READ);