[vlc-commits] demux: wav: stay within riff chunk boundaries (fix #10323)

[Francois Cartegnie]

vlc/vlc-2.1 | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Mon Jan  6 23:43:59 2014 +0100| [80c2f119ca2e8fdb698f9693f483086938a76897] | committer: Jean-Baptiste Kempf

demux: wav: stay within riff chunk boundaries (fix #10323)

(cherry picked from commit 9f0a91cb7e562fcfb72046b38a5f986c0e1bc0e3)
Signed-off-by: Jean-Baptiste Kempf <jb at videolan.org>

> http://git.videolan.org/gitweb.cgi/vlc/vlc-2.1.git/?a=commit;h=80c2f119ca2e8fdb698f9693f483086938a76897
---

 modules/demux/wav.c |   15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/modules/demux/wav.c b/modules/demux/wav.c
index 258ba7a..a58c402 100644
--- a/modules/demux/wav.c
+++ b/modules/demux/wav.c
@@ -442,15 +442,20 @@ static int Demux( demux_t *p_demux )
     demux_sys_t *p_sys = p_demux->p_sys;
     block_t     *p_block;
     const int64_t i_pos = stream_Tell( p_demux->s );
+    unsigned int i_read_size = p_sys->i_frame_size;
 
-    if( p_sys->i_data_size > 0 &&
-        i_pos >= p_sys->i_data_pos + p_sys->i_data_size )
+    if( p_sys->i_data_size > 0 )
     {
-        /* EOF */
-        return 0;
+        int64_t i_end = p_sys->i_data_pos + p_sys->i_data_size;
+        if ( i_pos >= i_end )
+            return 0;  /* EOF */
+
+        /* Don't read past data chunk boundary */
+        if ( i_end < i_pos + i_read_size )
+            i_read_size = i_end - i_pos;
     }
 
-    if( ( p_block = stream_Block( p_demux->s, p_sys->i_frame_size ) ) == NULL )
+    if( ( p_block = stream_Block( p_demux->s, i_read_size ) ) == NULL )
     {
         msg_Warn( p_demux, "cannot read data" );
         return 0;