diff options
| author | Robert Shih <robertshih@google.com> | 2017-12-07 06:09:18 +0000 |
|---|---|---|
| committer | android-build-merger <android-build-merger@google.com> | 2017-12-07 06:09:18 +0000 |
| commit | 21b3725820c12e4e53f0c77296cfdeb879b7bce5 (patch) | |
| tree | 463dba10f513cd9b205fa92e4d8ebb8def49422e | |
| parent | 2cb9f3a13ab0d4f8afd748ade3ee60e3ba77483e (diff) | |
| parent | 4938092976b879dd7e63af9d023d75b98744828e (diff) | |
| download | sonivox-21b3725820c12e4e53f0c77296cfdeb879b7bce5.tar.gz | |
Merge "Add recursion limit to XMF_ReadNode" into lmp-mr1-dev am: aa3e800009 am: 89077b7af8 am: 21d799e4d2 am: 6cca16e727 am: a0f0195ed9 am: a4a2f3ddb3 am: c37b57595a am: f4e4b72a7a am: 5fb87f3b75 am: 2dbc8b69ef am: b6ba13806c am: f56b92df2f am: 7b678a6e89
am: 4938092976
Change-Id: I180dd2aba414436cfa469528261b9b0f7be65efa
| -rw-r--r-- | arm-wt-22k/lib_src/eas_xmf.c | 13 |
1 files changed, 9 insertions, 4 deletions
diff --git a/arm-wt-22k/lib_src/eas_xmf.c b/arm-wt-22k/lib_src/eas_xmf.c index 169eb7e..07ee8f7 100644 --- a/arm-wt-22k/lib_src/eas_xmf.c +++ b/arm-wt-22k/lib_src/eas_xmf.c @@ -67,7 +67,7 @@ static EAS_RESULT XMF_Resume (S_EAS_DATA *pEASData, EAS_VOID_PTR pInstData); static EAS_RESULT XMF_SetData (S_EAS_DATA *pEASData, EAS_VOID_PTR pInstData, EAS_I32 param, EAS_I32 value); static EAS_RESULT XMF_GetData (S_EAS_DATA *pEASData, EAS_VOID_PTR pInstData, EAS_I32 param, EAS_I32 *pValue); static EAS_RESULT XMF_FindFileContents (EAS_HW_DATA_HANDLE hwInstData, S_XMF_DATA *pXMFData); -static EAS_RESULT XMF_ReadNode (EAS_HW_DATA_HANDLE hwInstData, S_XMF_DATA *pXMFData, EAS_I32 nodeOffset, EAS_I32 *pLength); +static EAS_RESULT XMF_ReadNode (EAS_HW_DATA_HANDLE hwInstData, S_XMF_DATA *pXMFData, EAS_I32 nodeOffset, EAS_I32 *pLength, EAS_I32 depth); static EAS_RESULT XMF_ReadVLQ (EAS_HW_DATA_HANDLE hwInstData, EAS_FILE_HANDLE fileHandle, EAS_I32 *value); @@ -504,6 +504,7 @@ static EAS_RESULT XMF_FindFileContents (EAS_HW_DATA_HANDLE hwInstData, S_XMF_DAT EAS_RESULT result; EAS_I32 value; EAS_I32 length; + EAS_I32 node_depth = 0 ; /* initialize offsets */ pXMFData->dlsOffset = pXMFData->midiOffset = 0; @@ -521,7 +522,7 @@ static EAS_RESULT XMF_FindFileContents (EAS_HW_DATA_HANDLE hwInstData, S_XMF_DAT /* get TreeStart offset and jump to it */ if ((result = XMF_ReadVLQ(hwInstData, pXMFData->fileHandle, &value)) != EAS_SUCCESS) return result; - if ((result = XMF_ReadNode(hwInstData, pXMFData, value, &length)) != EAS_SUCCESS) + if ((result = XMF_ReadNode(hwInstData, pXMFData, value, &length, node_depth)) != EAS_SUCCESS) return result; /* check for SMF data */ @@ -552,7 +553,7 @@ static EAS_RESULT XMF_FindFileContents (EAS_HW_DATA_HANDLE hwInstData, S_XMF_DAT * *---------------------------------------------------------------------------- */ -static EAS_RESULT XMF_ReadNode (EAS_HW_DATA_HANDLE hwInstData, S_XMF_DATA *pXMFData, EAS_I32 nodeOffset, EAS_I32 *pLength) +static EAS_RESULT XMF_ReadNode (EAS_HW_DATA_HANDLE hwInstData, S_XMF_DATA *pXMFData, EAS_I32 nodeOffset, EAS_I32 *pLength, EAS_I32 depth) { EAS_RESULT result; EAS_I32 refType; @@ -562,6 +563,10 @@ static EAS_RESULT XMF_ReadNode (EAS_HW_DATA_HANDLE hwInstData, S_XMF_DATA *pXMFD EAS_I32 headerLength; EAS_U32 chunkType; + /* check the depth of current node*/ + if ( depth > 100 ) + return EAS_ERROR_FILE_FORMAT; + /* seek to start of node */ if ((result = EAS_HWFileSeek(hwInstData, pXMFData->fileHandle, nodeOffset)) != EAS_SUCCESS) return result; @@ -656,7 +661,7 @@ static EAS_RESULT XMF_ReadNode (EAS_HW_DATA_HANDLE hwInstData, S_XMF_DATA *pXMFD return EAS_ERROR_FILE_FORMAT; } - if ((result = XMF_ReadNode(hwInstData, pXMFData, offset, &length)) != EAS_SUCCESS) + if ((result = XMF_ReadNode(hwInstData, pXMFData, offset, &length, depth+1)) != EAS_SUCCESS) return result; /* seek to start of next item */ |