60 lines
1.8 KiB
Diff
60 lines
1.8 KiB
Diff
From bdc392257c330e49872a5217dfb56becd1ee8f45 Mon Sep 17 00:00:00 2001
|
|
From: Tristan Matthews <tmatth@videolan.org>
|
|
Date: Tue, 11 Sep 2018 05:12:53 -0400
|
|
Subject: [PATCH] wav_io: check for EOF when seeking in wav
|
|
|
|
Fixes hang discovered by fuzzing: https://github.com/xiph/speex/issues/9
|
|
---
|
|
src/wav_io.c | 24 +++++++++++++++++-------
|
|
1 file changed, 17 insertions(+), 7 deletions(-)
|
|
|
|
diff --git a/src/wav_io.c b/src/wav_io.c
|
|
index c2e2bc85..b5183015 100644
|
|
--- a/src/wav_io.c
|
|
+++ b/src/wav_io.c
|
|
@@ -75,8 +75,11 @@ int read_wav_header(FILE *file, int *rate, int *channels, int *format, spx_int32
|
|
itmp = le_int(itmp);
|
|
/*fprintf (stderr, "skip=%d\n", itmp);*/
|
|
/*strange way of seeking, but it works even for pipes*/
|
|
- for (i=0;i<itmp;i++)
|
|
- fgetc(file);
|
|
+ for (i=0;i<itmp;i++) {
|
|
+ if (fgetc(file) == EOF) {
|
|
+ break;
|
|
+ }
|
|
+ }
|
|
/*fseek(file, itmp, SEEK_CUR);*/
|
|
fread(ch, 1, 4, file);
|
|
if (feof(file))
|
|
@@ -152,9 +155,13 @@ int read_wav_header(FILE *file, int *rate, int *channels, int *format, spx_int32
|
|
|
|
|
|
/*strange way of seeking, but it works even for pipes*/
|
|
- if (skip_bytes>0)
|
|
- for (i=0;i<skip_bytes;i++)
|
|
- fgetc(file);
|
|
+ if (skip_bytes>0) {
|
|
+ for (i=0;i<skip_bytes;i++) {
|
|
+ if (fgetc(file) == EOF) {
|
|
+ break;
|
|
+ }
|
|
+ }
|
|
+ }
|
|
|
|
/*fseek(file, skip_bytes, SEEK_CUR);*/
|
|
|
|
@@ -164,8 +171,11 @@ int read_wav_header(FILE *file, int *rate, int *channels, int *format, spx_int32
|
|
fread(&itmp, 4, 1, file);
|
|
itmp = le_int(itmp);
|
|
/*strange way of seeking, but it works even for pipes*/
|
|
- for (i=0;i<itmp;i++)
|
|
- fgetc(file);
|
|
+ for (i=0;i<itmp;i++) {
|
|
+ if (fgetc(file) == EOF) {
|
|
+ break;
|
|
+ }
|
|
+ }
|
|
/*fseek(file, itmp, SEEK_CUR);*/
|
|
fread(ch, 1, 4, file);
|
|
if (feof(file))
|