STORM-95 FIXED Fixed hanging of client when incorrect WAV file was passed.
As Aimee has found: "The data chunk of nexfire.wav has an incorrect length specified in its header which we blindly trust when reading the file in check_for_invalid_wav_formats() in llvorbisencode.cpp. It causes an overflow of the file position pointer when reading the file which makes it start over from the beginning, hanging it in an infinite loop." - To avoid this situation in future, check for chunk size was added, and if it is declared bigger then it may be, function is interrupted and returns error.master
parent
de6f7e19c4
commit
158bfc563b
|
|
@ -120,6 +120,13 @@ S32 check_for_invalid_wav_formats(const std::string& in_fname, std::string& erro
|
|||
+ ((U32) wav_header[5] << 8)
|
||||
+ wav_header[4];
|
||||
|
||||
if (chunk_length > physical_file_size - file_pos - 4)
|
||||
{
|
||||
infile.close();
|
||||
error_msg = "SoundFileInvalidChunkSize";
|
||||
return(LLVORBISENC_CHUNK_SIZE_ERR);
|
||||
}
|
||||
|
||||
// llinfos << "chunk found: '" << wav_header[0] << wav_header[1] << wav_header[2] << wav_header[3] << "'" << llendl;
|
||||
|
||||
if (!(strncmp((char *)&(wav_header[0]),"fmt ",4)))
|
||||
|
|
|
|||
|
|
@ -38,6 +38,7 @@ const S32 LLVORBISENC_MULTICHANNEL_ERR = 7; // can't do stereo
|
|||
const S32 LLVORBISENC_UNSUPPORTED_SAMPLE_RATE = 8; // unsupported sample rate
|
||||
const S32 LLVORBISENC_UNSUPPORTED_WORD_SIZE = 9; // unsupported word size
|
||||
const S32 LLVORBISENC_CLIP_TOO_LONG = 10; // source file is too long
|
||||
const S32 LLVORBISENC_CHUNK_SIZE_ERR = 11; // chunk size is wrong
|
||||
|
||||
const F32 LLVORBIS_CLIP_MAX_TIME = 10.0f;
|
||||
const U8 LLVORBIS_CLIP_MAX_CHANNELS = 2;
|
||||
|
|
|
|||
|
|
@ -1365,6 +1365,14 @@ Could not find 'data' chunk in WAV header:
|
|||
[FILE]
|
||||
</notification>
|
||||
|
||||
<notification
|
||||
icon="alertmodal.tga"
|
||||
name="SoundFileInvalidChunkSize"
|
||||
type="alertmodal">
|
||||
Wrong chunk size in WAV file:
|
||||
[FILE]
|
||||
</notification>
|
||||
|
||||
<notification
|
||||
icon="alertmodal.tga"
|
||||
name="SoundFileInvalidTooLong"
|
||||
|
|
|
|||
Loading…
Reference in New Issue