[vlc-commits] demux: avi: fix reading WAVEFORMATEX extra

[Francois Cartegnie]

vlc/vlc-3.0 | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Fri Dec  8 16:34:32 2017 +0100| [4dd10ad6c4f69fa93d29902d4a93cd0f84193c92] | committer: Francois Cartegnie

demux: avi: fix reading WAVEFORMATEX extra

(cherry picked from commit e7d72a7066e8ad45568efb7dc77a826dc6f76141)

> http://git.videolan.org/gitweb.cgi/vlc/vlc-3.0.git/?a=commit;h=4dd10ad6c4f69fa93d29902d4a93cd0f84193c92
---

 modules/demux/avi/avi.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/modules/demux/avi/avi.c b/modules/demux/avi/avi.c
index caa59f37af..568729c9d0 100644
--- a/modules/demux/avi/avi.c
+++ b/modules/demux/avi/avi.c
@@ -545,10 +545,13 @@ static int Open( vlc_object_t * p_this )
                     p_auds->p_wf->nSamplesPerSec,
                     p_auds->p_wf->wBitsPerSample );
 
-                if( p_auds->p_wf->cbSize > 0 && p_auds->i_chunk_size > sizeof(WAVEFORMATEX) )
+                const size_t i_cboff = sizeof(WAVEFORMATEX);
+                const size_t i_incboff = ( p_auds->p_wf->wFormatTag == WAVE_FORMAT_EXTENSIBLE ) ?
+                                          sizeof(WAVEFORMATEXTENSIBLE) - sizeof(WAVEFORMATEX): 0;
+                if( p_auds->i_chunk_size >= i_cboff + p_auds->p_wf->cbSize &&
+                    p_auds->p_wf->cbSize > i_incboff )
                 {
-                    int i_extra = __MIN( p_auds->p_wf->cbSize,
-                                         p_auds->i_chunk_size - sizeof(WAVEFORMATEX) );
+                    int i_extra = p_auds->p_wf->cbSize - i_incboff;
                     tk->fmt.p_extra = malloc( i_extra );
                     if( unlikely(tk->fmt.p_extra == NULL) )
                     {
@@ -557,7 +560,7 @@ static int Open( vlc_object_t * p_this )
                         goto error;
                     }
                     tk->fmt.i_extra = i_extra;
-                    memcpy( tk->fmt.p_extra, &p_auds->p_wf[1], tk->fmt.i_extra );
+                    memcpy( tk->fmt.p_extra, ((uint8_t *)(&p_auds->p_wf[1])) + i_incboff, i_extra );
                 }
                 break;
             }