Bug 523816 - Fix calculation of CMML record size. r=roc

--HG--
extra : rebase_source : a1f68e1f64581029b9624fd57a897f0085dd126b

content/media/test/Makefile.in

@@ -144,6 +144,7 @@ _TEST_FILES += \
 		bug520500.ogg \
 		bug520908.ogv \
 		bug520908.ogv^headers^ \
+		bug523816.ogv \
 		chain.ogv \
 		dirac.ogg \
 		seek.ogv \

content/media/test/manifest.js

@@ -61,6 +61,7 @@ var gPlayTests = [
   { name:"bug498855-3.ogv", type:"video/ogg", duration:0.2 },
   { name:"bug504644.ogv", type:"video/ogg", duration:1.56 },
   { name:"chain.ogv", type:"video/ogg", duration:Number.NaN },
+  { name:"bug523816.ogv", type:"video/ogg", duration:0.5 },
 
   { name:"bogus.duh", type:"bogus/duh" }
 ];

media/liboggplay/README_MOZILLA

@@ -44,3 +44,5 @@ fishsound_reset.patch: Fixes bug 516323.
 
 bug520493.patch: Ensure liboggplay returns data when all tracks
                  are deactivated when a callback reaches EOF.
+
+bug523816.patch: Correct CMML data buffer size calculation.

media/liboggplay/bug523816.patch

@@ -0,0 +1,29 @@
+diff --git a/media/liboggplay/src/liboggplay/oggplay_data.c b/media/liboggplay/src/liboggplay/oggplay_data.c
+--- a/media/liboggplay/src/liboggplay/oggplay_data.c
++++ b/media/liboggplay/src/liboggplay/oggplay_data.c
+@@ -353,22 +353,19 @@ oggplay_data_handle_audio_data (OggPlayD
+ OggPlayErrorCode
+ oggplay_data_handle_cmml_data(OggPlayDecode *decode, 
+                               unsigned char *data, 
+                               long size) {
+ 
+   OggPlayTextRecord * record = NULL;
+   size_t              record_size = sizeof(OggPlayTextRecord);
+ 
+-  /* check that the size we want to allocate doesn't overflow */
+-  if ((size < 0) || (size+1 < 0)) {
+-    return E_OGGPLAY_TYPE_OVERFLOW;
+-  }
+-  size += 1;
+-  
++  /* Include extra byte for null terminating record data buffer */
++  record_size += 1;
++
+   if 
+   (
+     oggplay_check_add_overflow (record_size, size, &record_size)
+     == 
+     E_OGGPLAY_TYPE_OVERFLOW
+   ) 
+   {
+     return E_OGGPLAY_TYPE_OVERFLOW;

media/liboggplay/src/liboggplay/oggplay_data.c

@@ -358,12 +358,9 @@ oggplay_data_handle_cmml_data(OggPlayDecode *decode,
   OggPlayTextRecord * record = NULL;
   size_t              record_size = sizeof(OggPlayTextRecord);
 
-  /* check that the size we want to allocate doesn't overflow */
-  if ((size < 0) || (size+1 < 0)) {
-    return E_OGGPLAY_TYPE_OVERFLOW;
-  }
-  size += 1;
-  
+  /* Include extra byte for null terminating record data buffer */
+  record_size += 1;
+
   if 
   (
     oggplay_check_add_overflow (record_size, size, &record_size)

media/liboggplay/update.sh

@@ -62,3 +62,4 @@ patch -p3 < fishsound_reset.patch
 patch -p3 < bug504843.patch
 patch -p3 < bug520493.patch
 patch -p3 < bug515217.patch
+patch -p3 < bug523816.patch