STORM-95 FIXED Fixed hanging of client when incorrect WAV file was passed.

As Aimee has found: "The data chunk of nexfire.wav has an incorrect length specified in its header which we blindly trust when reading
the file in check_for_invalid_wav_formats() in llvorbisencode.cpp. It causes an overflow of the file position pointer when reading the file which makes
it start over from the beginning, hanging it in an infinite loop."

- To avoid this situation in future, check for chunk size was added, and if it is declared bigger then it may be, function is interrupted and returns error.
meow-7.2.2
Andrew Productengine 2010-10-25 18:56:04 +03:00
parent de6f7e19c4
commit 158bfc563b
3 changed files with 16 additions and 0 deletions

View File

@ -120,6 +120,13 @@ S32 check_for_invalid_wav_formats(const std::string& in_fname, std::string& erro
+ ((U32) wav_header[5] << 8)
+ wav_header[4];
if (chunk_length > physical_file_size - file_pos - 4)
{
infile.close();
error_msg = "SoundFileInvalidChunkSize";
return(LLVORBISENC_CHUNK_SIZE_ERR);
}
// llinfos << "chunk found: '" << wav_header[0] << wav_header[1] << wav_header[2] << wav_header[3] << "'" << llendl;
if (!(strncmp((char *)&(wav_header[0]),"fmt ",4)))

View File

@ -38,6 +38,7 @@ const S32 LLVORBISENC_MULTICHANNEL_ERR = 7; // can't do stereo
const S32 LLVORBISENC_UNSUPPORTED_SAMPLE_RATE = 8; // unsupported sample rate
const S32 LLVORBISENC_UNSUPPORTED_WORD_SIZE = 9; // unsupported word size
const S32 LLVORBISENC_CLIP_TOO_LONG = 10; // source file is too long
const S32 LLVORBISENC_CHUNK_SIZE_ERR = 11; // chunk size is wrong
const F32 LLVORBIS_CLIP_MAX_TIME = 10.0f;
const U8 LLVORBIS_CLIP_MAX_CHANNELS = 2;

View File

@ -1365,6 +1365,14 @@ Could not find &apos;data&apos; chunk in WAV header:
[FILE]
</notification>
<notification
icon="alertmodal.tga"
name="SoundFileInvalidChunkSize"
type="alertmodal">
Wrong chunk size in WAV file:
[FILE]
</notification>
<notification
icon="alertmodal.tga"
name="SoundFileInvalidTooLong"