@@ -44,12 +44,13 @@ static struct MS_ADPCM_decoder {
44
44
struct MS_ADPCM_decodestate state [2 ];
45
45
} MS_ADPCM_state ;
46
46
47
- static int InitMS_ADPCM (WaveFMT * format )
47
+ static int InitMS_ADPCM (WaveFMT * format , int length )
48
48
{
49
- Uint8 * rogue_feel ;
49
+ Uint8 * rogue_feel , * rogue_feel_end ;
50
50
int i ;
51
51
52
52
/* Set the rogue pointer to the MS_ADPCM specific data */
53
+ if (length < sizeof (* format )) goto too_short ;
53
54
MS_ADPCM_state .wavefmt .encoding = SDL_SwapLE16 (format -> encoding );
54
55
MS_ADPCM_state .wavefmt .channels = SDL_SwapLE16 (format -> channels );
55
56
MS_ADPCM_state .wavefmt .frequency = SDL_SwapLE32 (format -> frequency );
@@ -58,9 +59,11 @@ static int InitMS_ADPCM(WaveFMT *format)
58
59
MS_ADPCM_state .wavefmt .bitspersample =
59
60
SDL_SwapLE16 (format -> bitspersample );
60
61
rogue_feel = (Uint8 * )format + sizeof (* format );
62
+ rogue_feel_end = (Uint8 * )format + length ;
61
63
if ( sizeof (* format ) == 16 ) {
62
64
rogue_feel += sizeof (Uint16 );
63
65
}
66
+ if (rogue_feel + 4 > rogue_feel_end ) goto too_short ;
64
67
MS_ADPCM_state .wSamplesPerBlock = ((rogue_feel [1 ]<<8 )|rogue_feel [0 ]);
65
68
rogue_feel += sizeof (Uint16 );
66
69
MS_ADPCM_state .wNumCoef = ((rogue_feel [1 ]<<8 )|rogue_feel [0 ]);
@@ -70,12 +73,16 @@ static int InitMS_ADPCM(WaveFMT *format)
70
73
return (-1 );
71
74
}
72
75
for ( i = 0 ; i < MS_ADPCM_state .wNumCoef ; ++ i ) {
76
+ if (rogue_feel + 4 > rogue_feel_end ) goto too_short ;
73
77
MS_ADPCM_state .aCoeff [i ][0 ] = ((rogue_feel [1 ]<<8 )|rogue_feel [0 ]);
74
78
rogue_feel += sizeof (Uint16 );
75
79
MS_ADPCM_state .aCoeff [i ][1 ] = ((rogue_feel [1 ]<<8 )|rogue_feel [0 ]);
76
80
rogue_feel += sizeof (Uint16 );
77
81
}
78
82
return (0 );
83
+ too_short :
84
+ SDL_SetError ("Unexpected length of a chunk with a MS ADPCM format" );
85
+ return (-1 );
79
86
}
80
87
81
88
static Sint32 MS_ADPCM_nibble (struct MS_ADPCM_decodestate * state ,
@@ -495,7 +502,7 @@ SDL_AudioSpec * SDL_LoadWAV_RW (SDL_RWops *src, int freesrc,
495
502
break ;
496
503
case MS_ADPCM_CODE :
497
504
/* Try to understand this */
498
- if ( InitMS_ADPCM (format ) < 0 ) {
505
+ if ( InitMS_ADPCM (format , lenread ) < 0 ) {
499
506
was_error = 1 ;
500
507
goto done ;
501
508
}
0 commit comments