Only check for the chunk's size to be lesser than 100 when reading the COMM_TAG.

This way, bigger audio chunks won't make the demuxer fail.

Fixes bug #6.

2 files changed, 10 insertions, 7 deletions

diff --git a/ChangeLog b/ChangeLog
index cbe0d5d7a..7e7e36e0c 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -34,6 +34,8 @@ xine-lib (1.1.9) (unreleased)
     possible to use the DJB accelerated FFT when using the external a52dec
     liba52 library.
   * Fixed an input_pvr issue with 'set input' for ivtv versions 0.10.6+
+  * demux_aiff: only check for chunk's size being lesser than 100 when
+    reading the COMM_TAG. [Bug #6]
 
 xine-lib (1.1.8)
   * Send a channel-changed event to the frontend when receiving the SYNC
diff --git a/src/demuxers/demux_aiff.c b/src/demuxers/demux_aiff.c
index 7fcaea70e..3f2d0df11 100644
--- a/src/demuxers/demux_aiff.c
+++ b/src/demuxers/demux_aiff.c
@@ -87,7 +87,6 @@ static int open_aiff_file(demux_aiff_t *this) {
   unsigned char preamble[PREAMBLE_SIZE];
   unsigned int chunk_type;
   unsigned int chunk_size;
-  unsigned char buffer[100];
 
   if (_x_demux_read_header(this->input, signature, AIFF_SIGNATURE_SIZE) != AIFF_SIGNATURE_SIZE)
     return 0;
@@ -118,13 +117,15 @@ static int open_aiff_file(demux_aiff_t *this) {
     chunk_type = _X_BE_32(&preamble[0]);
     chunk_size = _X_BE_32(&preamble[4]);
     
-    if (chunk_size > sizeof(buffer) / sizeof(buffer[0])) {
-      /* the chunk is too large to fit in the buffer -> this cannot be an aiff chunk */
-      this->status = DEMUX_FINISHED;
-      return 0;
-    }
-
     if (chunk_type == COMM_TAG) {
+      unsigned char buffer[100];
+
+      if (chunk_size > sizeof(buffer) / sizeof(buffer[0])) {
+	/* the chunk is too large to fit in the buffer -> this cannot be an aiff chunk */
+	this->status = DEMUX_FINISHED;
+	return 0;
+      }
+
       if (this->input->read(this->input, buffer, chunk_size) !=
         chunk_size) {
         this->status = DEMUX_FINISHED;