Update of /cvsroot/mplayer/0_90/libmpdemux In directory mail:/var/tmp.root/cvs-serv23275 Modified Files: demux_audio.c Log Message: backport: fixed extra header (cbSize>0) reading for .wav files Index: demux_audio.c =================================================================== RCS file: /cvsroot/mplayer/0_90/libmpdemux/demux_audio.c,v retrieving revision 1.16 retrieving revision 1.17 diff -u -r1.16 -r1.17 --- demux_audio.c 4 Dec 2002 23:51:44 -0000 1.16 +++ demux_audio.c 17 Mar 2003 00:53:27 -0000 1.17 @@ -157,21 +157,35 @@ unsigned int chunk_size; WAVEFORMATEX* w; int l; - sh_audio->wf = w = (WAVEFORMATEX*)malloc(sizeof(WAVEFORMATEX)); l = stream_read_dword_le(s); if(l < 16) { - printf("Bad wav header length : too short !!!\n"); + mp_msg(MSGT_DEMUX,MSGL_ERR,"[demux_audio] Bad wav header length: too short (%d)!!!\n",l); free_sh_audio(sh_audio); return 0; } + sh_audio->wf = w = (WAVEFORMATEX*)malloc(l); w->wFormatTag = sh_audio->format = stream_read_word_le(s); w->nChannels = sh_audio->channels = stream_read_word_le(s); w->nSamplesPerSec = sh_audio->samplerate = stream_read_dword_le(s); w->nAvgBytesPerSec = stream_read_dword_le(s); w->nBlockAlign = stream_read_word_le(s); w->wBitsPerSample = sh_audio->samplesize = stream_read_word_le(s); - w->cbSize = 0; l -= 16; + if (l > 0) { + w->cbSize = stream_read_word_le(s); + l -= 2; + if (w->cbSize > 0) + if (l < w->cbSize) { + mp_msg(MSGT_DEMUX,MSGL_ERR,"[demux_audio] truncated extradata (%d < %d)\n", + l,w->cbSize); + stream_read(s,(char*)((char*)(w)+sizeof(WAVEFORMATEX)),l); + l = 0; + } else { + stream_read(s,(char*)((char*)(w)+sizeof(WAVEFORMATEX)),w->cbSize); + l -= w->cbSize; + } + } + if(verbose>0) print_wave_header(w); if(l) stream_skip(s,l);