2 files changed, 65 insertions, 27 deletions

diff --git a/src/demuxers/demux_mpgaudio.c b/src/demuxers/demux_mpgaudio.c
index 27ee7f56b..549005bef 100644
--- a/src/demuxers/demux_mpgaudio.c
+++ b/src/demuxers/demux_mpgaudio.c
@@ -64,6 +64,7 @@
 
 /* Xing header stuff */
 #define XING_TAG FOURCC_TAG('X', 'i', 'n', 'g')
+#define INFO_TAG FOURCC_TAG('I', 'n', 'f', 'o')
 #define XING_FRAMES_FLAG     0x0001
 #define XING_BYTES_FLAG      0x0002
 #define XING_TOC_FLAG        0x0004
@@ -295,16 +296,8 @@ static int parse_frame_header(mpg_audio_frame_t *const frame, const uint8_t *con
  */
 static xing_header_t* parse_xing_header(mpg_audio_frame_t *frame,
                                         uint8_t *buf, int bufsize) {
-
-#ifdef LOG
-  int i;
-#endif
   uint8_t *ptr = buf;
-  xing_header_t *xing;
-
-  xing = xine_xmalloc (sizeof (xing_header_t));
-  if (!xing)
-    return NULL;
+  xing_header_t *xing = NULL;
 
   /* offset of the Xing header */
   if (frame->lsf_bit) {
@@ -319,52 +312,87 @@ static xing_header_t* parse_xing_header(mpg_audio_frame_t *frame,
       ptr += (9 + 4);
   }
   
-  if (ptr >= (buf + bufsize - 4)) return 0;
+  if (ptr >= (buf + bufsize - 4)) goto exit_error;
   lprintf("checking %08X\n", *ptr);
+  
   if (_X_BE_32(ptr) == XING_TAG) {
+    int has_frames_flag = 0;
+    int has_bytes_flag = 0;
+  
+    xing = xine_xmalloc (sizeof (xing_header_t));
+    if (!xing)
+      goto exit_error;
+  
     lprintf("Xing header found\n");
     ptr += 4;
     
-    if (ptr >= (buf + bufsize - 4)) return 0;
+    if (ptr >= (buf + bufsize - 4)) goto exit_error;
     xing->flags = _X_BE_32(ptr); ptr += 4;
 
     if (xing->flags & XING_FRAMES_FLAG) {
-      if (ptr >= (buf + bufsize - 4)) return 0;
+      if (ptr >= (buf + bufsize - 4)) goto exit_error;
       xing->stream_frames = _X_BE_32(ptr); ptr += 4;
       lprintf("stream frames: %d\n", xing->stream_frames);
+      has_frames_flag = 1;
     }
     if (xing->flags & XING_BYTES_FLAG) {
-      if (ptr >= (buf + bufsize - 4)) return 0;
+      if (ptr >= (buf + bufsize - 4)) goto exit_error;
       xing->stream_size = _X_BE_32(ptr); ptr += 4;
       lprintf("stream size: %d\n", xing->stream_size);
+      has_bytes_flag = 1;
+    }
+  
+    /* check if it's a useful Xing header */
+    if (!has_frames_flag || !has_bytes_flag) {
+      lprintf("Stupid Xing tag, cannot do anything with it !\n");
+      goto exit_error;
     }
+
     if (xing->flags & XING_TOC_FLAG) {
+      int i;
+
       lprintf("toc found\n");
-      if (ptr >= (buf + bufsize - XING_TOC_LENGTH)) return 0;
 
+      if (ptr >= (buf + bufsize - XING_TOC_LENGTH)) goto exit_error;
       memcpy(xing->toc, ptr, XING_TOC_LENGTH);
 #ifdef LOG
       for (i = 0; i < XING_TOC_LENGTH; i++) {
-        lprintf("%d ", xing->toc[i]);
+        printf("%d ", xing->toc[i]);
       }
-      lprintf("\n");
+      printf("\n");
 #endif
+      /* check the table validity
+       * - MUST start with 0
+       * - values MUST increase
+       */
+      if (xing->toc[0] != 0) {
+        lprintf("invalid Xing toc\n");
+        goto exit_error;
+      }
+      for (i = 1; i < XING_TOC_LENGTH; i++) {
+        if (xing->toc[i] < xing->toc[i-1]) {
+          lprintf("invalid Xing toc\n");
+          goto exit_error;
+        }
+      }
       ptr += XING_TOC_LENGTH;
     }
     xing->vbr_scale = -1;
     if (xing->flags & XING_VBR_SCALE_FLAG) {
-      if (ptr >= (buf + bufsize - 4)) return 0;
+      if (ptr >= (buf + bufsize - 4)) goto exit_error;
       xing->vbr_scale = _X_BE_32(ptr);
       lprintf("vbr_scale: %d\n", xing->vbr_scale);
     }
-
-    return xing;
   } else {
     lprintf("Xing header not found\n");
+  }
+  return xing;
+  
+exit_error:
+  lprintf("Xing header parse error\n");
     free(xing);
     return NULL;
   }
-}
 
 /*
  * Parse a Vbri header
@@ -919,7 +947,7 @@ static int demux_mpgaudio_seek (demux_plugin_t *this_gen,
 
     if (this->stream_length > 0) {
       if (this->xing_header &&
-          (this->xing_header->flags & (XING_TOC_FLAG | XING_BYTES_FLAG))) {
+          (this->xing_header->flags & XING_TOC_FLAG)) {
         seek_pos += xing_get_seek_point(this->xing_header, start_time, this->stream_length);
         lprintf("time seek: xing: time=%d, pos=%"PRId64"\n", start_time, seek_pos);
       } else if (this->vbri_header) {
diff --git a/src/demuxers/demux_real.c b/src/demuxers/demux_real.c
index 21308bd45..8f6ce0611 100644
--- a/src/demuxers/demux_real.c
+++ b/src/demuxers/demux_real.c
@@ -800,12 +800,22 @@ static int demux_real_parse_references( demux_real_t *this) {
 
   if (!strncmp(buf,"http://",7))
   {
-    for (i = 0; buf[i] && !isspace(buf[i]); ++i)
-      /**/;
-    buf[i] = 0;
-    lprintf("reference [%s] found\n", buf);
-
-    _x_demux_send_mrl_reference (this->stream, 0, buf, NULL, 0, 0);
+    i = 0;
+    while (buf[i])
+    {
+      j = i;
+      while (buf[i] && !isspace(buf[i]))
+	++i; /* skip non-space */
+      len = buf[i];
+      buf[i] = 0;
+      if (strncmp (buf + j, "http://", 7) || (i - j) < 8)
+        break; /* stop at the first non-http reference */
+      lprintf("reference [%s] found\n", buf + j);
+      _x_demux_send_mrl_reference (this->stream, 0, buf + j, NULL, 0, 0);
+      buf[i] = (char) len;
+      while (buf[i] && isspace(buf[i]))
+	++i; /* skip spaces */
+    }
   }
   else for (i = 0; i < buf_used; ++i)
   {