wma: Fix chunk_table computation.

diff --git a/wma_afh.c b/wma_afh.c
index 2d463900e7be81d148cd3ab6dce554d61ce3044a..9e5f5c60fd01afa7045a8afa2941d5554a91b367 100644 (file)
--- a/wma_afh.c
+++ b/wma_afh.c
@@ -205,6 +205,8 @@ static int wma_make_chunk_table(char *buf, size_t buf_size, int block_align,
        frames_per_chunk = num_frames / afhi->chunks_total;
        i = 0;
        j = 1;
+       start += afhi->header_len;
+       buf_size -= afhi->header_len;
        FOR_EACH_FRAME(f, start, buf_size, block_align) {
                count += f[WMA_FRAME_SKIP] & 0x0f;
                while (count > j * frames_per_chunk && f > start) {
@@ -216,7 +218,7 @@ static int wma_make_chunk_table(char *buf, size_t buf_size, int block_align,
                                        ct_size * sizeof(uint32_t));
                        }
                        PARA_DEBUG_LOG("ct[%d]: %zu\n", j, f - start);
-                       afhi->chunk_table[j] = f - start;
+                       afhi->chunk_table[j] = f - start + afhi->header_len;
                }
        }
        afhi->chunks_total = j;
@@ -244,8 +246,7 @@ static int wma_get_file_info(char *map, size_t numbytes, __a_unused int fd,
        afhi->header_len = ahi.header_len;
        afhi->header_offset = 0;
        read_asf_tags(map, ahi.header_len, &afhi->tags);
-       wma_make_chunk_table(map + ahi.header_len, numbytes - ahi.header_len,
-               ahi.block_align, afhi);
+       wma_make_chunk_table(map, numbytes, ahi.block_align, afhi);
        return 0;
 }
 

diff --git a/wma_common.c b/wma_common.c
index 5ea92c73948f70a66ff80aa830adba857f582a4f..be195e665cfb5eef751d678a8d41a00ce1701aed 100644 (file)
--- a/wma_common.c
+++ b/wma_common.c
@@ -25,8 +25,6 @@ const char *search_pattern(const char *pattern, int pattern_len, const char *buf
 {
        const char *p, *end = buf + buf_size;
 
-       if (pattern_len > buf_size)
-               return NULL;
        for (p = buf; p + pattern_len < end; p++) {
                if (memcmp(p, pattern, pattern_len))
                        continue;
@@ -80,6 +78,7 @@ int read_asf_header(char *buf, int loaded, struct asf_header_info *ahi)
        ret = find_audio_stream_info(buf, ahi->header_len);
        if (ret < 0)
                return ret;
+       /* FIXME: Check ranges */
        ahi->audio_stream_info_start = ret + 16;
        start = buf + ahi->audio_stream_info_start;