diff options
| author | yenatch <yenatch@gmail.com> | 2016-11-13 01:57:08 -0500 |
|---|---|---|
| committer | yenatch <yenatch@gmail.com> | 2016-11-13 02:04:55 -0500 |
| commit | 2fe1ee863818529c4ff3ebcd994d13754cc56d1d (patch) | |
| tree | a88d623464428f2b0c8e6ae8b3f794d43fe2f4e2 | |
| parent | 6dd4d9fd31542a7ac753f412c632528a66cc38a3 (diff) | |
aif2pcm: Avoid reading past eof.
| -rw-r--r-- | tools/aif2pcm/main.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/tools/aif2pcm/main.c b/tools/aif2pcm/main.c index 666da42dc..48e1492f6 100644 --- a/tools/aif2pcm/main.c +++ b/tools/aif2pcm/main.c @@ -118,7 +118,7 @@ AifData *read_aif(uint8_t * aif_file_data, unsigned long aif_file_data_size) unsigned long num_sample_frames = 0; // Read all the Chunks to populate the AifData struct. - while (pos < aif_file_data_size) + while ((pos + 8) < aif_file_data_size) { // Read Chunk id memcpy(chunk_name, aif_file_data + pos, 4); @@ -129,6 +129,11 @@ AifData *read_aif(uint8_t * aif_file_data, unsigned long aif_file_data_size) chunk_size |= (aif_file_data[pos++] << 8); chunk_size |= aif_file_data[pos++]; + if ((pos + chunk_size) > aif_file_data_size) + { + FATAL_ERROR("%s chunk at 0x%lx reached end of file before finishing\n", chunk_name, pos); + } + if (strcmp(chunk_name, "COMM") == 0) { short num_channels = (aif_file_data[pos++] << 8); |