fix buffer overrun in vorbis decoder

[xonotic/darkplaces.git] / snd_ogg.c

diff --git a/snd_ogg.c b/snd_ogg.c
index 4e1a713d4b86e47a56ad2fa57c0d7ad81e9f5ca1..9016656f9d361c68cca3b4c9a27b9b9d5e2be51a 100644 (file)
--- a/snd_ogg.c
+++ b/snd_ogg.c
@@ -158,6 +158,14 @@ typedef struct
        void                            *internal;
 } vorbis_block;
 
+typedef struct
+{
+       char **user_comments;
+       int   *comment_lengths;
+       int    comments;
+       char  *vendor;
+} vorbis_comment;
+
 typedef struct
 {
        void                            *datasource;
@@ -171,7 +179,7 @@ typedef struct
        long                            *serialnos;
        ogg_int64_t                     *pcmlengths;
        vorbis_info                     *vi;
-       void                            *vc;  // VOIDED POINTER
+       vorbis_comment          *vc;
        ogg_int64_t                     pcm_offset;
        int                                     ready_state;
        long                            current_serialno;
@@ -196,6 +204,8 @@ typedef struct
 // Functions exported from the vorbisfile library
 static int (*qov_clear) (OggVorbis_File *vf);
 static vorbis_info* (*qov_info) (OggVorbis_File *vf,int link);
+static vorbis_comment* (*qov_comment) (OggVorbis_File *vf,int link);
+static char * (*qvorbis_comment_query) (vorbis_comment *vc, char *tag, int count);
 static int (*qov_open_callbacks) (void *datasource, OggVorbis_File *vf,
                                                                  char *initial, long ibytes,
                                                                  ov_callbacks callbacks);
@@ -204,14 +214,21 @@ static ogg_int64_t (*qov_pcm_total) (OggVorbis_File *vf,int i);
 static long (*qov_read) (OggVorbis_File *vf,char *buffer,int length,
                                                 int bigendianp,int word,int sgned,int *bitstream);
 
-static dllfunction_t oggvorbisfuncs[] =
+static dllfunction_t vorbisfilefuncs[] =
 {
-       {"ov_clear",                    (void **) &qov_clear},
-       {"ov_info",                             (void **) &qov_info},
-       {"ov_open_callbacks",   (void **) &qov_open_callbacks},
-       {"ov_pcm_seek",                 (void **) &qov_pcm_seek},
-       {"ov_pcm_total",                (void **) &qov_pcm_total},
-       {"ov_read",                             (void **) &qov_read},
+       {"ov_clear",                            (void **) &qov_clear},
+       {"ov_info",                                     (void **) &qov_info},
+       {"ov_comment",                          (void **) &qov_comment},
+       {"ov_open_callbacks",           (void **) &qov_open_callbacks},
+       {"ov_pcm_seek",                         (void **) &qov_pcm_seek},
+       {"ov_pcm_total",                        (void **) &qov_pcm_total},
+       {"ov_read",                                     (void **) &qov_read},
+       {NULL, NULL}
+};
+
+static dllfunction_t vorbisfuncs[] =
+{
+       {"vorbis_comment_query",        (void **) &qvorbis_comment_query},
        {NULL, NULL}
 };
 
@@ -336,8 +353,8 @@ qboolean OGG_OpenLibrary (void)
        // Load the DLLs
        // We need to load both by hand because some OSes seem to not load
        // the vorbis DLL automatically when loading the VorbisFile DLL
-       if (! Sys_LoadLibrary (dllnames_vo, &vo_dll, NULL) ||
-               ! Sys_LoadLibrary (dllnames_vf, &vf_dll, oggvorbisfuncs))
+       if (! Sys_LoadLibrary (dllnames_vo, &vo_dll, vorbisfuncs) ||
+               ! Sys_LoadLibrary (dllnames_vf, &vf_dll, vorbisfilefuncs))
        {
                Sys_UnloadLibrary (&vo_dll);
                Con_Printf ("Ogg Vorbis support disabled\n");
@@ -529,6 +546,8 @@ static const snd_buffer_t* OGG_FetchSound (channel_t* ch, unsigned int* start, u
                return NULL;
        }
        newlength = per_sfx->format.speed * factor;  // -> 1 sec of sound before resampling
+       if(newlength > sizeof(resampling_buffer))
+               newlength = sizeof(resampling_buffer);
 
        // Decompress in the resampling_buffer
 #if BYTE_ORDER == BIG_ENDIAN
@@ -619,10 +638,12 @@ Load an Ogg Vorbis file into memory
 qboolean OGG_LoadVorbisFile (const char *filename, sfx_t *sfx)
 {
        unsigned char *data;
+       const char *loopcomment;
        fs_offset_t filesize;
        ov_decode_t ov_decode;
        OggVorbis_File vf;
        vorbis_info *vi;
+       vorbis_comment *vc;
        ogg_int64_t len, buff_len;
 
        if (!vf_dll)
@@ -685,6 +706,13 @@ qboolean OGG_LoadVorbisFile (const char *filename, sfx_t *sfx)
                sfx->flags |= SFXFLAG_STREAMED;
                sfx->total_length = (int)((size_t)len / (per_sfx->format.channels * 2) * ((double)snd_renderbuffer->format.speed / per_sfx->format.speed));
                sfx->loopstart = sfx->total_length;
+               vc = qov_comment(&vf, -1);
+               if(vc)
+               {
+                       loopcomment = qvorbis_comment_query(vc, "LOOP_START", 0);
+                       if(loopcomment)
+                               sfx->loopstart = bound(0, (unsigned int) (atof(loopcomment) * (double)snd_renderbuffer->format.speed / (double)per_sfx->format.speed), sfx->total_length);
+               }
        }
        else
        {
@@ -730,6 +758,13 @@ qboolean OGG_LoadVorbisFile (const char *filename, sfx_t *sfx)
 
                sfx->loopstart = sfx->total_length;
                sfx->flags &= ~SFXFLAG_STREAMED;
+               vc = qov_comment(&vf, -1);
+               if(vc)
+               {
+                       loopcomment = qvorbis_comment_query(vc, "LOOP_START", 0);
+                       if(loopcomment)
+                               sfx->loopstart = bound(0, (unsigned int) (atoi(loopcomment) * (double)snd_renderbuffer->format.speed / (double)sb->format.speed), sfx->total_length);
+               }
 
                qov_clear (&vf);
                Mem_Free (data);