STORM-95 FIXED Fixed hanging of client when incorrect WAV file was passed.
As Aimee has found: "The data chunk of nexfire.wav has an incorrect length specified in its header which we blindly trust when reading the file in check_for_invalid_wav_formats() in llvorbisencode.cpp. It causes an overflow of the file position pointer when reading the file which makes it start over from the beginning, hanging it in an infinite loop." - To avoid this situation in future, check for chunk size was added, and if it is declared bigger then it may be, function is interrupted and returns error.meow-7.2.2
parent
de6f7e19c4
commit
158bfc563b
|
|
@ -120,6 +120,13 @@ S32 check_for_invalid_wav_formats(const std::string& in_fname, std::string& erro
|
|||
+ ((U32) wav_header[5] << 8)
|
||||
+ wav_header[4];
|
||||
|
||||
if (chunk_length > physical_file_size - file_pos - 4)
|
||||
{
|
||||
infile.close();
|
||||
error_msg = "SoundFileInvalidChunkSize";
|
||||
return(LLVORBISENC_CHUNK_SIZE_ERR);
|
||||
}
|
||||
|
||||
// llinfos << "chunk found: '" << wav_header[0] << wav_header[1] << wav_header[2] << wav_header[3] << "'" << llendl;
|
||||
|
||||
if (!(strncmp((char *)&(wav_header[0]),"fmt ",4)))
|
||||
|
|
|
|||
|
|
@ -38,6 +38,7 @@ const S32 LLVORBISENC_MULTICHANNEL_ERR = 7; // can't do stereo
|
|||
const S32 LLVORBISENC_UNSUPPORTED_SAMPLE_RATE = 8; // unsupported sample rate
|
||||
const S32 LLVORBISENC_UNSUPPORTED_WORD_SIZE = 9; // unsupported word size
|
||||
const S32 LLVORBISENC_CLIP_TOO_LONG = 10; // source file is too long
|
||||
const S32 LLVORBISENC_CHUNK_SIZE_ERR = 11; // chunk size is wrong
|
||||
|
||||
const F32 LLVORBIS_CLIP_MAX_TIME = 10.0f;
|
||||
const U8 LLVORBIS_CLIP_MAX_CHANNELS = 2;
|
||||
|
|
|
|||
|
|
@ -1365,6 +1365,14 @@ Could not find 'data' chunk in WAV header:
|
|||
[FILE]
|
||||
</notification>
|
||||
|
||||
<notification
|
||||
icon="alertmodal.tga"
|
||||
name="SoundFileInvalidChunkSize"
|
||||
type="alertmodal">
|
||||
Wrong chunk size in WAV file:
|
||||
[FILE]
|
||||
</notification>
|
||||
|
||||
<notification
|
||||
icon="alertmodal.tga"
|
||||
name="SoundFileInvalidTooLong"
|
||||
|
|
|
|||
Loading…
Reference in New Issue