71 lines
2.6 KiB
Diff
71 lines
2.6 KiB
Diff
|
--- a/src/audio/SDL_wave.c 2012-01-19 14:30:06.000000000 +0800
|
||
|
|
+++ b/src/audio/SDL_wave.c 2019-04-22 15:40:50.023000000 +0800
|
||
|
|
@@ -115,7 +115,7 @@ static Sint32 MS_ADPCM_nibble(struct MS_ADPCM_decodestate *state,
|
||
|
|
static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
|
||
|
|
{
|
||
|
|
struct MS_ADPCM_decodestate *state[2];
|
||
|
|
- Uint8 *freeable, *encoded, *decoded;
|
||
|
|
+ Uint8 *freeable, *encoded, *encoded_end, *decoded;
|
||
|
|
Sint32 encoded_len, samplesleft;
|
||
|
|
Sint8 nybble, stereo;
|
||
|
|
Sint16 *coeff[2];
|
||
|
|
@@ -124,6 +124,7 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
|
||
|
|
/* Allocate the proper sized output buffer */
|
||
|
|
encoded_len = *audio_len;
|
||
|
|
encoded = *audio_buf;
|
||
|
|
+ encoded_end = encoded + encoded_len;
|
||
|
|
freeable = *audio_buf;
|
||
|
|
*audio_len = (encoded_len/MS_ADPCM_state.wavefmt.blockalign) *
|
||
|
|
MS_ADPCM_state.wSamplesPerBlock*
|
||
|
|
@@ -141,6 +142,7 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
|
||
|
|
state[1] = &MS_ADPCM_state.state[stereo];
|
||
|
|
while ( encoded_len >= MS_ADPCM_state.wavefmt.blockalign ) {
|
||
|
|
/* Grab the initial information for this block */
|
||
|
|
+ if (encoded + 7 + (stereo ? 7 : 0) > encoded_end) goto too_short;
|
||
|
|
state[0]->hPredictor = *encoded++;
|
||
|
|
if ( stereo ) {
|
||
|
|
state[1]->hPredictor = *encoded++;
|
||
|
|
@@ -188,6 +190,8 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
|
||
|
|
samplesleft = (MS_ADPCM_state.wSamplesPerBlock-2)*
|
||
|
|
MS_ADPCM_state.wavefmt.channels;
|
||
|
|
while ( samplesleft > 0 ) {
|
||
|
|
+ if (encoded + 1 > encoded_end) goto too_short;
|
||
|
|
+
|
||
|
|
nybble = (*encoded)>>4;
|
||
|
|
new_sample = MS_ADPCM_nibble(state[0],nybble,coeff[0]);
|
||
|
|
decoded[0] = new_sample&0xFF;
|
||
|
|
@@ -209,6 +213,10 @@ static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
|
||
|
|
}
|
||
|
|
SDL_free(freeable);
|
||
|
|
return(0);
|
||
|
|
+too_short:
|
||
|
|
+ SDL_SetError("Too short chunk for a MS ADPCM decoder");
|
||
|
|
+ SDL_free(freeable);
|
||
|
|
+ return(-1);
|
||
|
|
}
|
||
|
|
|
||
|
|
struct IMA_ADPCM_decodestate {
|
||
|
|
--- a/src/audio/SDL_wave.c 2019-04-22 04:32:30.989000000 -0400
|
||
|
|
+++ b/src/audio/SDL_wave.c 2019-04-22 05:26:47.003000000 -0400
|
||
|
|
@@ -154,6 +154,9 @@ static int MS_ADPCM_decode(Uint8 **audio
|
||
|
|
if ( stereo ) {
|
||
|
|
state[1]->hPredictor = *encoded++;
|
||
|
|
}
|
||
|
|
+ if (state[0]->hPredictor >= 7 || state[1]->hPredictor >= 7) {
|
||
|
|
+ goto invalid_predictor;
|
||
|
|
+ }
|
||
|
|
state[0]->iDelta = ((encoded[1]<<8)|encoded[0]);
|
||
|
|
encoded += sizeof(Sint16);
|
||
|
|
if ( stereo ) {
|
||
|
|
@@ -224,6 +227,10 @@ too_short:
|
||
|
|
SDL_SetError("Too short chunk for a MS ADPCM decoder");
|
||
|
|
SDL_free(freeable);
|
||
|
|
return(-1);
|
||
|
|
+invalid_predictor:
|
||
|
|
+ SDL_SetError("Invalid predictor value for a MS ADPCM decoder");
|
||
|
|
+ SDL_free(freeable);
|
||
|
|
+ return(-1);
|
||
|
|
}
|
||
|
|
|
||
|
|
struct IMA_ADPCM_decodestate {
|