[vlc-commits] [Git][videolan/vlc][master] contrib: modplug: backport MIDI buffer read overflow fixes
Steve Lhomme (@robUx4)
gitlab at videolan.org
Sun Sep 6 05:01:04 UTC 2026
Steve Lhomme pushed to branch master at VideoLAN / VLC
Commits:
66881caf by Steve Lhomme at 2026-09-06T04:18:04+00:00
contrib: modplug: backport MIDI buffer read overflow fixes
Fixes #29899
- - - - -
3 changed files:
- + contrib/src/modplug/0001-Fix-misc.-bugs-found-by-libfuzzer.patch
- + contrib/src/modplug/0002-Fix-MIDI-issues-from-the-fuzz-patch-1-oob_read_fixes.patch
- contrib/src/modplug/rules.mak
Changes:
=====================================
contrib/src/modplug/0001-Fix-misc.-bugs-found-by-libfuzzer.patch
=====================================
@@ -0,0 +1,267 @@
+From d5940d6e60e59a40096b4145a2b6e241bd6a94a0 Mon Sep 17 00:00:00 2001
+From: AliceLR <petrifiedrowan at gmail.com>
+Date: Sat, 12 Jun 2021 22:00:46 -0600
+Subject: [PATCH 1/2] Fix misc. bugs found by libfuzzer.
+
+* Fix out-of-bounds reads in the DSMI AMF loader caused by missing
+ order list bounds checks.
+* Fix out-of-bounds reads in the FAR loader caused by not correctly
+ bounding the maximum pattern read size.
+* Fix out-of-bounds reads in the IT sample decompressors caused by
+ allowing ITReadBits to read past the end of the sample buffer.
+* Fix out-of-bounds reads in the MED loader caused by the MMD2PLAYSEQ
+ table bounds check not including the size of the offset being read.
+* Fix out-of-bounds reads in the MIDI loader caused by no bounds
+ checks being performed on the mmread* and mid_read* functions.
+* Fix leaks in the MIDI loader caused by not freeing MIDTRACKs.
+* Fix leak and hangs in the MIDI loader caused by not releasing the
+ MIDI structs and reentry flag when m_nChannels is 0.
+* Fix out-of-bounds reads in the OKT loader caused by numerous bounds
+ checks not correctly including the size of the data being read.
+* Fix out-of-bounds reads in the PSM loader caused by dereferencing
+ (PSMCHUNK *)lpStream before any bounds checks.
+* Fix out-of-bounds reads in the S3M loader due to various absent
+ bounds checks.
+* Fix out-of-bounds reads in the ULT loader due to incorrect event
+ bounding.
+* Fix out-of-bounds reads in the XM loader due to not including the
+ size of XMINSTRUMENTHEADER in the XMSAMPLEHEADER bounds check.
+
+(cherry picked from commit 04c5d455f5b0cb0e6ed49541ef80181156f9ec1c)
+Signed-off-by: Steve Lhomme <robux4 at ycbcr.xyz>
+---
+ src/load_mid.cpp | 81 ++++++++++++++++++++++++++++++------------------
+ 1 file changed, 51 insertions(+), 30 deletions(-)
+
+diff --git a/src/load_mid.cpp b/src/load_mid.cpp
+index 5992fa6..b088ded 100644
+--- a/src/load_mid.cpp
++++ b/src/load_mid.cpp
+@@ -105,6 +105,7 @@ typedef struct {
+ char *mm;
+ unsigned int sz;
+ int pos;
++ int err;
+ } MMFILE;
+
+ static void mmfseek(MMFILE *mmfile, long p, int whence)
+@@ -130,21 +131,38 @@ static long mmftell(MMFILE *mmfile)
+ static BYTE mmreadUBYTE(MMFILE *mmfile)
+ {
+ BYTE b;
++ if ((unsigned int)mmfile->pos >= mmfile->sz)
++ {
++ mmfile->err = EOF;
++ return 0;
++ }
+ b = (BYTE)mmfile->mm[mmfile->pos];
+ mmfile->pos++;
+ return b;
+ }
+
+-static void mmreadUBYTES(BYTE *buf, long sz, MMFILE *mmfile)
++static unsigned long mmreadUBYTES(BYTE *buf, unsigned long sz, MMFILE *mmfile)
+ {
++ if ((unsigned long)mmfile->pos + sz >= mmfile->sz)
++ {
++ mmfile->err = EOF;
++ return 0;
++ }
+ memcpy(buf, &mmfile->mm[mmfile->pos], sz);
+ mmfile->pos += sz;
++ return sz;
+ }
+
+-static void mmreadSBYTES(char *buf, long sz, MMFILE *mmfile)
++static unsigned long mmreadSBYTES(char *buf, long sz, MMFILE *mmfile)
+ {
++ if ((unsigned long)mmfile->pos + sz >= mmfile->sz)
++ {
++ mmfile->err = EOF;
++ return 0;
++ }
+ memcpy(buf, &mmfile->mm[mmfile->pos], sz);
+ mmfile->pos += sz;
++ return sz;
+ }
+
+ /**********************************************************************/
+@@ -709,14 +727,15 @@ static void mid_add_pitchwheel(MIDHANDLE *h, int mch, int wheel)
+ static uint32_t mid_read_long(MIDHANDLE *h)
+ {
+ BYTE buf[4];
+- mmreadUBYTES(buf, 4, h->mmf);
++ if (!mmreadUBYTES(buf, 4, h->mmf)) return -1;
++
+ return (buf[0]<<24)|(buf[1]<<16)|(buf[2]<<8)|buf[3];
+ }
+
+ static short int mid_read_short(MIDHANDLE *h)
+ {
+ BYTE buf[2];
+- mmreadUBYTES(buf, 2, h->mmf);
++ if (!mmreadUBYTES(buf, 2, h->mmf)) return -1;
+ return (buf[0]<<8)|buf[1];
+ }
+
+@@ -750,6 +769,7 @@ BOOL CSoundFile::TestMID(const BYTE *lpStream, DWORD dwMemLength)
+ MMFILE mm;
+ mm.mm = (char *)lpStream;
+ mm.sz = dwMemLength;
++ mm.err = 0;
+ h.mmf = &mm;
+ if (h.mmf->sz < 4) return FALSE;
+ mmfseek(h.mmf,0,SEEK_SET);
+@@ -791,6 +811,7 @@ static void MID_CleanupTracks(MIDHANDLE *handle)
+ for( tp=handle->track; tp; tp = tn ) {
+ tn=tp->next;
+ MID_CleanupTrack(tp);
++ free(tp);
+ }
+ handle->track = NULL;
+ }
+@@ -1172,19 +1193,14 @@ BOOL CSoundFile::ReadMID(const BYTE *lpStream, DWORD dwMemLength)
+ BYTE *p;
+ while( avoid_reentry ) sleep(1);
+ avoid_reentry = 1;
+- if( !TestMID(lpStream, dwMemLength) ) {
+- avoid_reentry = 0;
+- return FALSE;
+- }
++ if( !TestMID(lpStream, dwMemLength) ) goto ErrorExit;
+ h = MID_Init();
+- if( !h ) {
+- avoid_reentry = 0;
+- return FALSE;
+- }
++ if( !h ) goto ErrorExit;
+ h->mmf = &mm;
+ mm.mm = (char *)lpStream;
+ mm.sz = dwMemLength;
+ mm.pos = 0;
++ mm.err = 0;
+ h->debug = getenv(ENV_MMMID_DEBUG);
+ h->verbose = getenv(ENV_MMMID_VERBOSE);
+ pat_resetsmp();
+@@ -1193,6 +1209,8 @@ BOOL CSoundFile::ReadMID(const BYTE *lpStream, DWORD dwMemLength)
+ h->midiformat = mid_read_short(h);
+ h->miditracks = mid_read_short(h);
+ h->resolution = mid_read_short(h);
++ if (mm.err) goto ErrorCleanup;
++
+ // at this point the h->mmf is positioned at first miditrack
+ if( h->midiformat == 0 ) h->miditracks = 1;
+ if( h->resolution & 0x8000 )
+@@ -1205,11 +1223,8 @@ BOOL CSoundFile::ReadMID(const BYTE *lpStream, DWORD dwMemLength)
+ m_nDefaultTempo = 0;
+ h->tracktime = 0;
+ h->speed = 6;
+- if (h->miditracks == 0) {
+- MID_Cleanup(h);
+- avoid_reentry = 0;
+- return FALSE;
+- }
++ if (h->miditracks == 0) goto ErrorCleanup;
++
+ p = (BYTE *)getenv(ENV_MMMID_SPEED);
+ if( p && isdigit(*p) && p[0] != '0' && p[1] == '\0' ) {
+ // transform speed
+@@ -1247,19 +1262,18 @@ BOOL CSoundFile::ReadMID(const BYTE *lpStream, DWORD dwMemLength)
+ }
+ for( t=0; t<(uint32_t)h->miditracks; t++ ) {
+ if( h->verbose ) printf("Parsing track %d\n", t+1);
+- mmreadSBYTES(buf,4,h->mmf);
++ if (!mmreadSBYTES(buf,4,h->mmf)) goto ErrorCleanup;
+ buf[4] = '\0';
+ if( strcmp(buf,"MTrk") ) {
+ mid_message("invalid track-chunk '%s' is not 'MTrk'",buf);
+- MID_Cleanup(h);
+- avoid_reentry = 0;
+- return FALSE;
++ goto ErrorCleanup;
+ }
+ miditracklen = mid_read_long(h);
+- if (mm.sz < miditracklen) continue;
++ if (mm.err || mm.sz < miditracklen) continue;
+ runningstatus = 0;
+ if( t && h->midiformat == 1 ) mid_rewind_tracks(h); // tracks sound simultaneously
+ while( miditracklen > 0 ) {
++ if (mm.err) break;
+ miditracklen -= mid_read_delta(h);
+ midibyte[0] = mid_read_byte(h);
+ miditracklen--;
+@@ -1378,6 +1392,7 @@ BOOL CSoundFile::ReadMID(const BYTE *lpStream, DWORD dwMemLength)
+ t, (long)(h->tracktime), midibyte[0]);
+ while( midibyte[0] != 0xf7 ) {
+ midibyte[0] = mid_read_byte(h);
++ if (mm.err) break;
+ miditracklen--;
+ if( h->debug ) printf(" %02X", midibyte[0]);
+ }
+@@ -1399,6 +1414,7 @@ BOOL CSoundFile::ReadMID(const BYTE *lpStream, DWORD dwMemLength)
+ t, (long)(h->tracktime), metalen);
+ while( metalen > 0 ) {
+ midibyte[1] = mid_read_byte(h);
++ if (mm.err) break;
+ metalen--;
+ miditracklen--;
+ if( h->debug ) printf(" %02X", midibyte[1]);
+@@ -1411,13 +1427,14 @@ BOOL CSoundFile::ReadMID(const BYTE *lpStream, DWORD dwMemLength)
+ metalen = h->deltatime;
+ if( metalen > 31 ) metalen = 31;
+ if( metalen ) {
+- mmreadSBYTES(buf, metalen, h->mmf);
++ if (!mmreadSBYTES(buf, metalen, h->mmf)) break;
+ miditracklen -= metalen;
+ }
+ buf[metalen] = '\0';
+ metalen = h->deltatime - metalen;
+ while( metalen > 0 ) {
+ midibyte[1] = mid_read_byte(h);
++ if (mm.err) break;
+ metalen--;
+ miditracklen--;
+ }
+@@ -1467,7 +1484,7 @@ BOOL CSoundFile::ReadMID(const BYTE *lpStream, DWORD dwMemLength)
+ }
+ if( miditracklen < 1 && (runningstatus != 0xff || midibyte[0] != 0x2f) ) {
+ delta = mmftell(h->mmf);
+- mmreadSBYTES(buf,4,h->mmf);
++ if (!mmreadSBYTES(buf,4,h->mmf)) break;
+ buf[4] = '\0';
+ if( strcmp(buf,"MTrk") ) {
+ miditracklen = 0x7fffffff;
+@@ -1545,15 +1562,13 @@ BOOL CSoundFile::ReadMID(const BYTE *lpStream, DWORD dwMemLength)
+ m_dwSongFlags = SONG_LINEARSLIDES;
+ m_nMinPeriod = 28 << 2;
+ m_nMaxPeriod = 1712 << 3;
+- if (m_nChannels == 0)
+- return FALSE;
++ if (m_nChannels == 0) goto ErrorCleanup;
++
+ // orderlist
+ for(t=0; t < numpats; t++)
+ Order[t] = t;
+- if( !PAT_Load_Instruments(this) ) {
+- avoid_reentry = 0;
+- return FALSE;
+- }
++ if( !PAT_Load_Instruments(this) ) goto ErrorCleanup;
++
+ // ==============================
+ // Load the pattern info now!
+ if( MID_ReadPatterns(Patterns, PatternSize, h, numpats, m_nChannels) ) {
+@@ -1581,4 +1596,10 @@ BOOL CSoundFile::ReadMID(const BYTE *lpStream, DWORD dwMemLength)
+ MID_Cleanup(h); // we dont need it anymore
+ avoid_reentry = 0; // it is safe now, I'm finished
+ return TRUE;
++
++ErrorCleanup:
++ MID_Cleanup(h);
++ErrorExit:
++ avoid_reentry = 0;
++ return FALSE;
+ }
+--
+2.52.0.windows.1
+
=====================================
contrib/src/modplug/0002-Fix-MIDI-issues-from-the-fuzz-patch-1-oob_read_fixes.patch
=====================================
@@ -0,0 +1,296 @@
+From 175feec746c616485f4e22f84e1a7498a16a57e0 Mon Sep 17 00:00:00 2001
+From: AliceLR <petrifiedrowan at gmail.com>
+Date: Fri, 28 Jan 2022 21:54:26 -0700
+Subject: [PATCH 2/2] Fix MIDI issues from the fuzz-patch-1/oob_read_fixes
+ merge.
+
+The merge between these patches broke some important hang fixes
+in fuzz-patch-1. There weren't any particularly good options for
+reconciling these, but the least bad one seemed to be getting rid
+of the unnecessary extra IO abstraction and moving the EOF state
+flag to the mid_read_* functions.
+
+Also fixes a -Wsign-compare warning at (former) line 1294.
+
+(cherry picked from commit 96cf6eeb7701872b72745ae10e5411a7a39f0333)
+Signed-off-by: Steve Lhomme <robux4 at ycbcr.xyz>
+---
+ src/load_mid.cpp | 155 ++++++++++++++++++-----------------------------
+ 1 file changed, 58 insertions(+), 97 deletions(-)
+
+diff --git a/src/load_mid.cpp b/src/load_mid.cpp
+index b088ded..57a6139 100644
+--- a/src/load_mid.cpp
++++ b/src/load_mid.cpp
+@@ -101,75 +101,14 @@ typedef struct _MIDTRACK
+ #define _mm_recalloc(h,buf,sz,elsz) realloc(buf,sz)
+ #define _mm_free(h,p) free(p)
+
+-typedef struct {
+- char *mm;
+- unsigned int sz;
+- int pos;
+- int err;
+-} MMFILE;
+-
+-static void mmfseek(MMFILE *mmfile, long p, int whence)
+-{
+- switch(whence) {
+- case SEEK_SET:
+- mmfile->pos = p;
+- break;
+- case SEEK_CUR:
+- mmfile->pos += p;
+- break;
+- case SEEK_END:
+- mmfile->pos = mmfile->sz + p;
+- break;
+- }
+-}
+-
+-static long mmftell(MMFILE *mmfile)
+-{
+- return mmfile->pos;
+-}
+-
+-static BYTE mmreadUBYTE(MMFILE *mmfile)
+-{
+- BYTE b;
+- if ((unsigned int)mmfile->pos >= mmfile->sz)
+- {
+- mmfile->err = EOF;
+- return 0;
+- }
+- b = (BYTE)mmfile->mm[mmfile->pos];
+- mmfile->pos++;
+- return b;
+-}
+-
+-static unsigned long mmreadUBYTES(BYTE *buf, unsigned long sz, MMFILE *mmfile)
+-{
+- if ((unsigned long)mmfile->pos + sz >= mmfile->sz)
+- {
+- mmfile->err = EOF;
+- return 0;
+- }
+- memcpy(buf, &mmfile->mm[mmfile->pos], sz);
+- mmfile->pos += sz;
+- return sz;
+-}
+-
+-static unsigned long mmreadSBYTES(char *buf, long sz, MMFILE *mmfile)
+-{
+- if ((unsigned long)mmfile->pos + sz >= mmfile->sz)
+- {
+- mmfile->err = EOF;
+- return 0;
+- }
+- memcpy(buf, &mmfile->mm[mmfile->pos], sz);
+- mmfile->pos += sz;
+- return sz;
+-}
+-
+ /**********************************************************************/
+
+ typedef struct _MIDHANDLE
+ {
+- MMFILE *mmf;
++ const BYTE *mm;
++ unsigned long sz;
++ unsigned long pos;
++ int err;
+ MIDTRACK *track;
+ MIDTRACK *tp;
+ ULONG tracktime;
+@@ -727,21 +666,45 @@ static void mid_add_pitchwheel(MIDHANDLE *h, int mch, int wheel)
+ static uint32_t mid_read_long(MIDHANDLE *h)
+ {
+ BYTE buf[4];
+- if (!mmreadUBYTES(buf, 4, h->mmf)) return -1;
+-
++ if (h->pos > h->sz - 4) {
++ h->err = EOF;
++ return 0;
++ }
++ memcpy(buf, h->mm + h->pos, 4);
++ h->pos += 4;
+ return (buf[0]<<24)|(buf[1]<<16)|(buf[2]<<8)|buf[3];
+ }
+
+ static short int mid_read_short(MIDHANDLE *h)
+ {
+ BYTE buf[2];
+- if (!mmreadUBYTES(buf, 2, h->mmf)) return -1;
++ if (h->pos > h->sz - 2) {
++ h->err = EOF;
++ return 0;
++ }
++ memcpy(buf, h->mm + h->pos, 2);
++ h->pos += 2;
+ return (buf[0]<<8)|buf[1];
+ }
+
+ static BYTE mid_read_byte(MIDHANDLE *h)
+ {
+- return mmreadUBYTE(h->mmf);
++ if (h->pos >= h->sz) {
++ h->err = EOF;
++ return 0;
++ }
++ return h->mm[h->pos++];
++}
++
++static unsigned long mid_read_bytes(void *dest, unsigned long sz, MIDHANDLE *h)
++{
++ if (sz > h->sz || h->pos > h->sz - sz) {
++ h->err = EOF;
++ return 0;
++ }
++ memcpy(dest, h->mm + h->pos, sz);
++ h->pos += sz;
++ return sz;
+ }
+
+ static int mid_read_delta(MIDHANDLE *h)
+@@ -766,14 +729,12 @@ BOOL CSoundFile::TestMID(const BYTE *lpStream, DWORD dwMemLength)
+ {
+ char id[5];
+ MIDHANDLE h;
+- MMFILE mm;
+- mm.mm = (char *)lpStream;
+- mm.sz = dwMemLength;
+- mm.err = 0;
+- h.mmf = &mm;
+- if (h.mmf->sz < 4) return FALSE;
+- mmfseek(h.mmf,0,SEEK_SET);
+- mmreadSBYTES(id, 4, h.mmf);
++ if (dwMemLength < 14) return FALSE;
++ h.mm = lpStream;
++ h.sz = dwMemLength;
++ h.pos = 0;
++ h.err = 0;
++ mid_read_bytes(id, 4, &h);
+ id[4] = '\0';
+ return !strcmp(id,"MThd") && mid_read_long(&h) == 6;
+ }
+@@ -1180,7 +1141,6 @@ BOOL CSoundFile::ReadMID(const BYTE *lpStream, DWORD dwMemLength)
+ {
+ static int avoid_reentry = 0;
+ MIDHANDLE *h;
+- MMFILE mm;
+ int ch, dmulti, maxtempo, panlow, panhigh, numchans, numtracks;
+ MIDTRACK *ttp;
+ uint32_t t, numpats;
+@@ -1196,22 +1156,21 @@ BOOL CSoundFile::ReadMID(const BYTE *lpStream, DWORD dwMemLength)
+ if( !TestMID(lpStream, dwMemLength) ) goto ErrorExit;
+ h = MID_Init();
+ if( !h ) goto ErrorExit;
+- h->mmf = &mm;
+- mm.mm = (char *)lpStream;
+- mm.sz = dwMemLength;
+- mm.pos = 0;
+- mm.err = 0;
++ h->mm = lpStream;
++ h->sz = dwMemLength;
++ h->err = 0;
+ h->debug = getenv(ENV_MMMID_DEBUG);
+ h->verbose = getenv(ENV_MMMID_VERBOSE);
+ pat_resetsmp();
+ pat_init_patnames();
+- mmfseek(h->mmf,8,SEEK_SET);
+- h->midiformat = mid_read_short(h);
++
++ h->pos = 8;
++ h->midiformat = mid_read_short(h);
+ h->miditracks = mid_read_short(h);
+ h->resolution = mid_read_short(h);
+- if (mm.err) goto ErrorCleanup;
++ if (h->err) goto ErrorCleanup;
+
+- // at this point the h->mmf is positioned at first miditrack
++ // at this point the h->pos is positioned at first miditrack
+ if( h->midiformat == 0 ) h->miditracks = 1;
+ if( h->resolution & 0x8000 )
+ h->divider = ((h->resolution & 0x7f00)>>8)*(h->resolution & 0xff);
+@@ -1262,18 +1221,20 @@ BOOL CSoundFile::ReadMID(const BYTE *lpStream, DWORD dwMemLength)
+ }
+ for( t=0; t<(uint32_t)h->miditracks; t++ ) {
+ if( h->verbose ) printf("Parsing track %d\n", t+1);
+- if (!mmreadSBYTES(buf,4,h->mmf)) goto ErrorCleanup;
++ if (mid_read_bytes(buf,4,h) < 4) {
++ buf[0] = '\0'; // make sure start is \0
++ }
+ buf[4] = '\0';
+ if( strcmp(buf,"MTrk") ) {
+ mid_message("invalid track-chunk '%s' is not 'MTrk'",buf);
+ goto ErrorCleanup;
+ }
+ miditracklen = mid_read_long(h);
+- if (mm.err || mm.sz < miditracklen) continue;
++ if (h->err || h->sz < miditracklen) continue;
+ runningstatus = 0;
+ if( t && h->midiformat == 1 ) mid_rewind_tracks(h); // tracks sound simultaneously
+ while( miditracklen > 0 ) {
+- if (mm.err) break;
++ if (h->err) break;
+ miditracklen -= mid_read_delta(h);
+ midibyte[0] = mid_read_byte(h);
+ miditracklen--;
+@@ -1392,7 +1353,7 @@ BOOL CSoundFile::ReadMID(const BYTE *lpStream, DWORD dwMemLength)
+ t, (long)(h->tracktime), midibyte[0]);
+ while( midibyte[0] != 0xf7 ) {
+ midibyte[0] = mid_read_byte(h);
+- if (mm.err) break;
++ if (h->err) break;
+ miditracklen--;
+ if( h->debug ) printf(" %02X", midibyte[0]);
+ }
+@@ -1414,7 +1375,7 @@ BOOL CSoundFile::ReadMID(const BYTE *lpStream, DWORD dwMemLength)
+ t, (long)(h->tracktime), metalen);
+ while( metalen > 0 ) {
+ midibyte[1] = mid_read_byte(h);
+- if (mm.err) break;
++ if (h->err) break;
+ metalen--;
+ miditracklen--;
+ if( h->debug ) printf(" %02X", midibyte[1]);
+@@ -1427,14 +1388,14 @@ BOOL CSoundFile::ReadMID(const BYTE *lpStream, DWORD dwMemLength)
+ metalen = h->deltatime;
+ if( metalen > 31 ) metalen = 31;
+ if( metalen ) {
+- if (!mmreadSBYTES(buf, metalen, h->mmf)) break;
++ if (!mid_read_bytes(buf, metalen, h)) break;
+ miditracklen -= metalen;
+ }
+ buf[metalen] = '\0';
+ metalen = h->deltatime - metalen;
+ while( metalen > 0 ) {
+ midibyte[1] = mid_read_byte(h);
+- if (mm.err) break;
++ if (h->err) break;
+ metalen--;
+ miditracklen--;
+ }
+@@ -1483,8 +1444,8 @@ BOOL CSoundFile::ReadMID(const BYTE *lpStream, DWORD dwMemLength)
+ break;
+ }
+ if( miditracklen < 1 && (runningstatus != 0xff || midibyte[0] != 0x2f) ) {
+- delta = mmftell(h->mmf);
+- if (!mmreadSBYTES(buf,4,h->mmf)) break;
++ delta = h->pos;
++ if (!mid_read_bytes(buf,4,h)) break;
+ buf[4] = '\0';
+ if( strcmp(buf,"MTrk") ) {
+ miditracklen = 0x7fffffff;
+@@ -1492,7 +1453,7 @@ BOOL CSoundFile::ReadMID(const BYTE *lpStream, DWORD dwMemLength)
+ }
+ else
+ mid_message("Meta event not at end of track, %s bytes left in track", "no");
+- mmfseek(h->mmf,delta,SEEK_SET);
++ h->pos = delta;
+ }
+ }
+ }
+--
+2.52.0.windows.1
+
=====================================
contrib/src/modplug/rules.mak
=====================================
@@ -18,6 +18,8 @@ $(TARBALLS)/libmodplug-$(MODPLUG_VERSION).tar.gz:
libmodplug: libmodplug-$(MODPLUG_VERSION).tar.gz .sum-modplug
$(UNPACK)
# $(call update_autoconfig,.)
+ $(APPLY) $(SRC)/modplug/0001-Fix-misc.-bugs-found-by-libfuzzer.patch
+ $(APPLY) $(SRC)/modplug/0002-Fix-MIDI-issues-from-the-fuzz-patch-1-oob_read_fixes.patch
$(APPLY) $(SRC)/modplug/modplug-win32-static.patch
$(APPLY) $(SRC)/modplug/macosx-do-not-force-min-version.patch
$(APPLY) $(SRC)/modplug/fix-endianness-check.diff
View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/66881cafbd6959ef77374345cefac40f059db0bc
--
View it on GitLab: https://code.videolan.org/videolan/vlc/-/commit/66881cafbd6959ef77374345cefac40f059db0bc
You're receiving this email because of your account on code.videolan.org. Manage all notifications: https://code.videolan.org/-/profile/notifications | Help: https://code.videolan.org/help
More information about the vlc-commits
mailing list