server: Don't save bogus chunk table for aac files.

[paraslash.git] / aft.c

diff --git a/aft.c b/aft.c
index 6aeb0589dbef919a4fcae2bb9d5a8de58f9a9a60..4fb60f91687e96a67e0169a1d3eeecf97f272bd1 100644 (file)
--- a/aft.c
+++ b/aft.c
@@ -1638,7 +1638,8 @@ static int com_add_callback(struct afs_callback_arg *aca)
        char asc[2 * HASH2_SIZE + 1];
        int ret;
        char afsi_buf[AFSI_SIZE];
-       char *slpr = buf + read_u32(buf + CAB_LPR_OFFSET);
+       uint32_t slpr_offset = read_u32(buf + CAB_LPR_OFFSET);
+       char *slpr = buf + slpr_offset;
        struct afs_info default_afsi = {.last_played = 0};
        uint16_t afhi_offset, chunks_offset;
        const struct lls_command *cmd = SERVER_CMD_CMD_PTR(ADD);
@@ -1706,6 +1707,7 @@ static int com_add_callback(struct afs_callback_arg *aca)
        /* no hs or force mode, child must have sent afhi */
        afhi_offset = read_u32(buf + CAB_AFHI_OFFSET_POS);
        chunks_offset = read_u32(buf + CAB_CHUNKS_OFFSET_POS);
+       assert(chunks_offset <= slpr_offset);
 
        objs[AFTCOL_AFHI].data = buf + afhi_offset;
        objs[AFTCOL_AFHI].size = chunks_offset - afhi_offset;
@@ -1713,7 +1715,7 @@ static int com_add_callback(struct afs_callback_arg *aca)
        if (!objs[AFTCOL_AFHI].size) /* "impossible" */
                goto out;
        objs[AFTCOL_CHUNKS].data = buf + chunks_offset;
-       objs[AFTCOL_CHUNKS].size = aca->query.size - chunks_offset;
+       objs[AFTCOL_CHUNKS].size = slpr_offset - chunks_offset;
        if (pb && !hs) { /* update pb's hash */
                char old_asc[2 * HASH2_SIZE + 1];
                unsigned char *old_hash;