4050b0b53e
Various integer overflows and off-by-one errors in libmodplug.
29 lines
1.3 KiB
Plaintext
29 lines
1.3 KiB
Plaintext
$OpenBSD: patch-src_load_ams_cpp,v 1.1 2011/08/18 17:56:47 jasper Exp $
|
|
|
|
AMSv2 off by one problem (related to SA45131/C)
|
|
From upstream git: 16d7a78efe14d345a6c5b241f88422ad0ee483ea
|
|
|
|
Fix AMS and DSM too large by one - SA45131/C
|
|
From upstream git: 26243ab9fe1171f70053e9aec4b20e9f7de9e4ef
|
|
|
|
--- src/load_ams.cpp.orig Thu Aug 18 19:49:58 2011
|
|
+++ src/load_ams.cpp Thu Aug 18 19:52:09 2011
|
|
@@ -52,7 +52,7 @@ BOOL CSoundFile::ReadAMS(LPCBYTE lpStream, DWORD dwMem
|
|
|
|
if ((!lpStream) || (dwMemLength < 1024)) return FALSE;
|
|
if ((pfh->verhi != 0x01) || (strncmp(pfh->szHeader, "Extreme", 7))
|
|
- || (!pfh->patterns) || (!pfh->orders) || (!pfh->samples) || (pfh->samples > MAX_SAMPLES)
|
|
+ || (!pfh->patterns) || (!pfh->orders) || (!pfh->samples) || (pfh->samples >= MAX_SAMPLES)
|
|
|| (pfh->patterns > MAX_PATTERNS) || (pfh->orders > MAX_ORDERS))
|
|
{
|
|
return ReadAMS2(lpStream, dwMemLength);
|
|
@@ -321,7 +321,7 @@ BOOL CSoundFile::ReadAMS2(LPCBYTE lpStream, DWORD dwMe
|
|
dwMemPos = pfh->titlelen + 8;
|
|
psh = (AMS2SONGHEADER *)(lpStream + dwMemPos);
|
|
if (((psh->version & 0xFF00) != 0x0200) || (!psh->instruments)
|
|
- || (psh->instruments > MAX_INSTRUMENTS) || (!psh->patterns) || (!psh->orders)) return FALSE;
|
|
+ || (psh->instruments >= MAX_INSTRUMENTS) || (!psh->patterns) || (!psh->orders)) return FALSE;
|
|
dwMemPos += sizeof(AMS2SONGHEADER);
|
|
if (pfh->titlelen)
|
|
{
|