4050b0b53e
Various integer overflows and off-by-one errors in libmodplug.
17 lines
739 B
Plaintext
17 lines
739 B
Plaintext
$OpenBSD: patch-src_load_wav_cpp,v 1.1 2011/08/18 17:56:48 jasper Exp $
|
|
|
|
Fix integer overflow (SA45131/A)
|
|
From upstream git: 2d4c56de314ab13e4437bd8b609f0b751066eee8
|
|
|
|
--- src/load_wav.cpp.orig Thu Aug 18 19:37:38 2011
|
|
+++ src/load_wav.cpp Thu Aug 18 19:37:57 2011
|
|
@@ -54,7 +54,7 @@ BOOL CSoundFile::ReadWav(const BYTE *lpStream, DWORD d
|
|
if ((Patterns[1] = AllocatePattern(64, 4)) == NULL) return TRUE;
|
|
UINT samplesize = (pfmt->channels * pfmt->bitspersample) >> 3;
|
|
UINT len = pdata->length, bytelen;
|
|
- if (dwMemPos + len > dwMemLength - 8) len = dwMemLength - dwMemPos - 8;
|
|
+ if (len > dwMemLength - 8 - dwMemPos) len = dwMemLength - dwMemPos - 8;
|
|
len /= samplesize;
|
|
bytelen = len;
|
|
if (pfmt->bitspersample >= 16) bytelen *= 2;
|