Use a bitmask, and ensure that the values reported by wavpack for bits_per_sample and channels (that have sane limits) are inside the boundaries, this way we don't end up eating memory in the case of a malformed wavpack file. While we're at it, also try to compact the size of the wavpack structures.

CVS patchset: 8623
CVS date: 2007/02/25 17:52:16

2 files changed, 21 insertions, 14 deletions

diff --git a/src/combined/decoder_wavpack.c b/src/combined/decoder_wavpack.c
index ea843cd16..60bd13bca 100644
--- a/src/combined/decoder_wavpack.c
+++ b/src/combined/decoder_wavpack.c
@@ -19,7 +19,7 @@
  *
  * xine interface to libwavpack by Diego Pettenò <flameeyes@gmail.com>
  *
- * $Id: decoder_wavpack.c,v 1.8 2007/02/25 17:34:48 dgp85 Exp $
+ * $Id: decoder_wavpack.c,v 1.9 2007/02/25 17:52:16 dgp85 Exp $
  */
 
 #define LOG_MODULE "decode_wavpack"
@@ -40,11 +40,11 @@ typedef struct {
 
   xine_stream_t    *stream;
 
-  int               output_open;
-
   int               sample_rate;
-  int               bits_per_sample;
-  int               channels;
+  uint16_t          bits_per_sample:6;
+  uint16_t          channels:4;
+
+  uint16_t          output_open:1;
 
   uint8_t          *buf;
   size_t            buf_size;
@@ -123,7 +123,7 @@ static int xine_buffer_can_seek(void *const this_gen) {
 static int32_t xine_buffer_write_bytes(__unused void *const id,
 				      __unused void *const data,
 				      __unused const int32_t bcount) {
-  lprintf("xine_buffer_write_bytes: acces is read-only.\n");
+  lprintf("xine_buffer_write_bytes: access is read-only.\n");
   return 0;
 }
 
@@ -155,7 +155,9 @@ static void wavpack_decode_data (audio_decoder_t *const this_gen, buf_element_t
         int mode = AO_CAP_MODE_MONO;
 
         this->sample_rate     = buf->decoder_info[1];
+	_x_assert(buf->decoder_info[2] <= 32);
         this->bits_per_sample = buf->decoder_info[2];
+	_x_assert(buf->decoder_info[3] <= 8);
         this->channels        = buf->decoder_info[3];
 
 	mode = _x_ao_channels2mode(this->channels);
@@ -170,7 +172,7 @@ static void wavpack_decode_data (audio_decoder_t *const this_gen, buf_element_t
                                             this->stream,
                                             this->bits_per_sample,
                                             this->sample_rate,
-                                            mode);
+                                            mode) ? 1 : 0;
         }
         this->buf_pos = 0;
     } else if (this->output_open) {
diff --git a/src/combined/demux_wavpack.c b/src/combined/demux_wavpack.c
index bb43a590c..6f5cf68ff 100644
--- a/src/combined/demux_wavpack.c
+++ b/src/combined/demux_wavpack.c
@@ -19,7 +19,7 @@
  *
  * xine interface to libwavpack by Diego Pettenò <flameeyes@gmail.com>
  *
- * $Id: demux_wavpack.c,v 1.8 2007/02/25 17:34:48 dgp85 Exp $
+ * $Id: demux_wavpack.c,v 1.9 2007/02/25 17:52:16 dgp85 Exp $
  */
 
 #define LOG_MODULE "demux_wavpack"
@@ -46,8 +46,8 @@ typedef struct {
   uint32_t current_sample;
   uint32_t samples;
   uint32_t samplerate;
-  uint32_t bits_per_sample;
-  uint32_t channels;
+  uint16_t bits_per_sample:6;
+  uint16_t channels:4;
 } demux_wv_t;
 
 typedef struct {
@@ -118,6 +118,7 @@ static int open_wv_file(demux_wv_t *const this) {
   WavpackContext *ctx = NULL;
   char error[256]; /* Current version of wavpack (4.31) does not write more than this */
   wvheader_t header;
+  uint32_t tmp;
 
   /* Right now we don't support non-seekable streams */
   if (! INPUT_IS_SEEKABLE(this->input) ) {
@@ -147,10 +148,14 @@ static int open_wv_file(demux_wv_t *const this) {
   lprintf("number of samples: %u\n", this->samples);
   this->samplerate = WavpackGetSampleRate(ctx);
   lprintf("samplerate: %u Hz\n", this->samplerate);
-  this->bits_per_sample = WavpackGetBitsPerSample(ctx);
-  lprintf("bits_per_sample: %u\n", this->bits_per_sample);
-  this->channels = WavpackGetNumChannels(ctx);
-  lprintf("channels: %u\n", this->channels);
+
+  tmp = WavpackGetBitsPerSample(ctx); _x_assert(tmp <= 32);
+  lprintf("bits_per_sample: %u\n", tmp);
+  this->bits_per_sample = tmp;
+
+  tmp = WavpackGetNumChannels(ctx); _x_assert(tmp <= 8);
+  lprintf("channels: %u\n", tmp);
+  this->channels = tmp;
 
   _x_stream_info_set(this->stream, XINE_STREAM_INFO_HAS_AUDIO, 1);
   _x_stream_info_set(this->stream, XINE_STREAM_INFO_AUDIO_FOURCC,