Changeset 302

Timestamp:

05/02/07 22:31:31 (18 years ago)

Author:

r2d

Message:

• added some checks in sv8 demuxing
• corrected a bug in mpc2sv8

Location:

libmpc/trunk

Files:

• libmpcdec/mpc_demux.c (modified) (6 diffs)
• mpc2sv8/mpc2sv8.c (modified) (1 diff)

libmpc/trunk/libmpcdec/mpc_demux.c

@@ -101 +101 @@
         }
 
-        return 0;
+        return (mpc_uint32_t) -1;
 }
 
@@ -367 +367 @@
 {
         mpc_bits_reader r;
+        int pos = 0;
         if (d->si.stream_version >= 8) {
                 i->is_key_frame = MPC_FALSE;
@@ -379 +380 @@
                         mpc_demux_fill(d, 11, 0); // max header block size
                         mpc_bits_get_block(&d->bits_reader, &b);
+                        pos = mpc_demux_pos(d) >> 3;
                         while( memcmp(b.key, "AP", 2) != 0 ) { // scan all blocks until audio
+                                if (b.key[0] < 65 || b.key[0] > 90 || b.key[1] < 65 || b.key[1] > 90
+                                                                || b.size > (mpc_uint64_t) DEMUX_BUFFER_SIZE - 11)
+                                        goto error;
                                 if (memcmp(b.key, "SE", 2) == 0) { // end block
                                         i->bits = -1;
                                         return MPC_STATUS_OK;
                                 }
-                                mpc_demux_fill(d, 11 + (mpc_uint32_t) b.size, 0);
+                                if (mpc_demux_fill(d, 11 + (mpc_uint32_t) b.size, 0) == 0)
+                                        goto error;
                                 d->bits_reader.buff += b.size;
                                 mpc_bits_get_block(&d->bits_reader, &b);
@@ -392 +398 @@
                         i->is_key_frame = MPC_TRUE;
                 }
-                if (d->buffer + d->bytes_total - d->bits_reader.buff <= MAX_FRAME_SIZE)
+                if (d->buffer + d->bytes_total - d->bits_reader.buff <= MAX_FRAME_SIZE * 2)
                         mpc_demux_fill(d, (d->block_bits >> 3) + 1, 0);
                 r = d->bits_reader;
@@ -398 +404 @@
                 d->block_bits -= ((d->bits_reader.buff - r.buff) << 3) + r.count - d->bits_reader.count;
                 d->block_frames--;
-                if (d->block_bits < 0 || (d->block_frames == 0 && d->block_bits > 7)) {
-                        i->bits = -1; // we pretend it's end of file
-                        return MPC_STATUS_INVALIDSV;
-                }
+                if (d->block_bits < 0 || (d->block_frames == 0 && d->block_bits > 7))
+                        goto error;
         } else {
                 if (d->d->decoded_samples == (d->seek_table_size << d->seek_pwr) * MPC_FRAME_LENGTH) {
@@ -412 +416 @@
                 r = d->bits_reader;
                 mpc_decoder_decode_frame(d->d, &d->bits_reader, i);
-                if (i->bits != -1 && d->block_bits != ((d->bits_reader.buff - r.buff) << 3) + r.count - d->bits_reader.count) {
-                        i->bits = -1; // we pretend it's end of file
-                        return MPC_STATUS_INVALIDSV;
-                }
-        }
-        if (d->buffer + d->bytes_total < d->bits_reader.buff + ((8 - d->bits_reader.count) >> 3)) {
+                if (i->bits != -1 && d->block_bits != ((d->bits_reader.buff - r.buff) << 3) + r.count - d->bits_reader.count)
+                        goto error;
+        }
+        if (d->buffer + d->bytes_total < d->bits_reader.buff + ((8 - d->bits_reader.count) >> 3))
+                goto error;
+
+        return MPC_STATUS_OK;
+error:
                 i->bits = -1; // we pretend it's end of file
-                return MPC_STATUS_INVALIDSV;
-        }
-        return MPC_STATUS_OK;
+                // return MPC_STATUS_INVALIDSV;
+                return pos;
 }
 

libmpc/trunk/mpc2sv8/mpc2sv8.c

@@ -177 +177 @@
 
         // copy end of file
-        stream_size = (((mpc_demux_pos(demux) + 7) >> 3) - si.header_position + 3) & ~3;
+
+        stream_size = (((mpc_demux_pos(demux) + 7 - 20) >> 3) - si.header_position + 3) & ~3;
         fseek(in_file, si.header_position + stream_size, SEEK_SET);
         while((r_size = fread(buf, 1, TMP_BUF_SIZE, in_file))) {