read_asf_header() sanity-check header len.

[paraslash.git] / wma_common.c

diff --git a/wma_common.c b/wma_common.c
index c4d96ad0f62c396cac54e3fcdabca87974f241d6..3326cfff6148128f08ebc3b388ee82711a3c9ed5 100644 (file)
--- a/wma_common.c
+++ b/wma_common.c
@@ -18,15 +18,13 @@
 #include "error.h"
 #include "afh.h"
 #include "portable_io.h"
-#include "mdct.h"
+#include "imdct.h"
 #include "wma.h"
 
 const char *search_pattern(const char *pattern, int pattern_len, const char *buf, int buf_size)
 {
        const char *p, *end = buf + buf_size;
 
-       if (pattern_len > buf_size)
-               return NULL;
        for (p = buf; p + pattern_len < end; p++) {
                if (memcmp(p, pattern, pattern_len))
                        continue;
@@ -49,36 +47,47 @@ static int find_audio_stream_info(const char *buf, int len)
        if (!p)
                return -E_WMA_NO_GUID;
        PARA_DEBUG_LOG("found audio stream guid@%0zx\n", p - buf);
-       return p - buf;
+       return p - buf + 16;
 }
 
 static int read_header_len(char *buf, int len)
 {
        uint16_t header_len;
 
+       if (len < 18)
+               return 0;
        header_len = read_u16(buf + 16) + 46;
-       if (header_len > len)
-               return -E_WMA_BAD_ASF_HEADER;
        PARA_DEBUG_LOG("header_len: %d\n", header_len);
        return header_len;
 }
 
+/**
+ * Read an asf audio file header.
+ *
+ * \param buf The input buffer.
+ * \param loaded Number of bytes in \a buf.
+ * \param ahi Result pointer.
+ *
+ * \return Negative on errors, zero if more data is needed in order to read the
+ * full header, 1 on success.
+ */
 int read_asf_header(char *buf, int loaded, struct asf_header_info *ahi)
 {
        int ret;
        char *start;
 
-       ret = read_header_len(buf, loaded);
-       if (ret < 0)
-               return ret;
-       ahi->header_len = ret;
-
+       ahi->header_len = read_header_len(buf, loaded);
+       if (ahi->header_len == 0) /* too short to read header len */
+               return 0;
+       if (ahi->header_len > loaded) /* too short to read header */
+               return 0;
        ret = find_audio_stream_info(buf, ahi->header_len);
        if (ret < 0)
                return ret;
-       ahi->audio_stream_info_start = ret + 16;
+       if (ret + 62 > loaded)
+               return 0;
+       ahi->audio_stream_info_start = ret;
        start = buf + ahi->audio_stream_info_start;
-
        ahi->channels = ((uint8_t *)start)[40];
        ahi->sample_rate = read_u16(start + 42);
        PARA_NOTICE_LOG("%d channels, sample rate: %d\n", ahi->channels,
@@ -94,7 +103,7 @@ int read_asf_header(char *buf, int loaded, struct asf_header_info *ahi)
        ahi->flags2 = read_u16(start + 60);
        PARA_INFO_LOG("read_asf_header: flags1: %d, flag2: %d\n",
                ahi->flags1, ahi->flags2);
-       return 42;
+       return 1;
 }
 
 const uint8_t log2_tab[256] = {