demux: wav: stay within riff chunk boundaries (fix #10323)
authorFrancois Cartegnie <fcvlcdev@free.fr>
Mon, 6 Jan 2014 22:43:59 +0000 (23:43 +0100)
committerFelix Paul Kühne <fkuehne@videolan.org>
Sat, 8 Feb 2014 16:05:33 +0000 (17:05 +0100)
(cherry picked from commit 9f0a91cb7e562fcfb72046b38a5f986c0e1bc0e3)
Signed-off-by: Felix Paul Kühne <fkuehne@videolan.org>
modules/demux/wav.c

index 4a96f0e..15bd9ef 100644 (file)
@@ -404,15 +404,20 @@ static int Demux( demux_t *p_demux )
     demux_sys_t *p_sys = p_demux->p_sys;
     block_t     *p_block;
     const int64_t i_pos = stream_Tell( p_demux->s );
+    unsigned int i_read_size = p_sys->i_frame_size;
 
-    if( p_sys->i_data_size > 0 &&
-        i_pos >= p_sys->i_data_pos + p_sys->i_data_size )
+    if( p_sys->i_data_size > 0 )
     {
-        /* EOF */
-        return 0;
+        int64_t i_end = p_sys->i_data_pos + p_sys->i_data_size;
+        if ( i_pos >= i_end )
+            return 0;  /* EOF */
+
+        /* Don't read past data chunk boundary */
+        if ( i_end < i_pos + i_read_size )
+            i_read_size = i_end - i_pos;
     }
 
-    if( ( p_block = stream_Block( p_demux->s, p_sys->i_frame_size ) ) == NULL )
+    if( ( p_block = stream_Block( p_demux->s, i_read_size ) ) == NULL )
     {
         msg_Warn( p_demux, "cannot read data" );
         return 0;