X-Git-Url: http://git.tuebingen.mpg.de/?a=blobdiff_plain;f=aft.c;h=1756ec04ab5582edd97ab1b73bd2d777657495ec;hb=5afe721aeb241bd21b832994ec2f2b7d8ff84766;hp=8b9d85b5d1010ea57b779082969a21700bd12b93;hpb=e0f54e42887a8beef092755f5ed9cdf6d499bef2;p=paraslash.git

diff --git a/aft.c b/aft.c
index 8b9d85b5..1756ec04 100644
--- a/aft.c
+++ b/aft.c
@@ -437,13 +437,13 @@ static uint32_t save_chunk_table(struct afh_info *afhi, char *buf)
 	return max;
 }
 
-static void load_chunk_table(struct afh_info *afhi, char *buf)
+static void load_chunk_table(struct afh_info *afhi, const struct osl_object *ct)
 {
 	int i;
 
 	afhi->chunk_table = para_malloc(sizeof_chunk_table(afhi));
-	for (i = 0; i <= afhi->chunks_total; i++)
-		afhi->chunk_table[i] = read_u32(buf + 4 * i);
+	for (i = 0; i <= afhi->chunks_total && i * 4 + 3 < ct->size; i++)
+		afhi->chunk_table[i] = read_u32(ct->data + 4 * i);
 }
 
 /**
@@ -663,14 +663,22 @@ int load_afd(int shmid, struct audio_file_data *afd)
 {
 	void *shm_afd;
 	int ret;
+	struct osl_object obj;
 
 	ret = shm_attach(shmid, ATTACH_RO, &shm_afd);
 	if (ret < 0)
 		return ret;
+	ret = shm_size(shmid, &obj.size);
+	if (ret < 0)
+		goto detach;
 	*afd = *(struct audio_file_data *)shm_afd;
-	load_chunk_table(&afd->afhi, shm_afd + sizeof(*afd));
+	obj.data = shm_afd + sizeof(*afd);
+	obj.size -= sizeof(*afd);
+	load_chunk_table(&afd->afhi, &obj);
+	ret = 1;
+detach:
 	shm_detach(shm_afd);
-	return 1;
+	return ret;
 }
 
 static int get_local_time(uint64_t *seconds, char *buf, size_t size,
@@ -1076,7 +1084,7 @@ again:
 	save_afsi(&new_afsi, &afsi_obj); /* in-place update */
 
 	afd->audio_format_id = d->afsi.audio_format_id;
-	load_chunk_table(&afd->afhi, chunk_table_obj.data);
+	load_chunk_table(&afd->afhi, &chunk_table_obj);
 	aced.aft_row = current_aft_row;
 	aced.old_afsi = &d->afsi;
 	/*