Bug 1080986 - Check list chunk is large enough to read list ID before reading. r=giles

2014-10-15 13:56:09 +13:00 · 2014-10-15 13:56:09 +13:00 · c86db74252
--- a/content/media/test/crashtests/1080986.html
+++ b/content/media/test/crashtests/1080986.html
@ -0,0 +1,3 @@
+<html>
+<audio autoplay src="1080986.wav"></audio>
+</html>
--- a/content/media/test/crashtests/1080986.wav
+++ b/content/media/test/crashtests/1080986.wav
--- a/content/media/test/crashtests/crashtests.list
+++ b/content/media/test/crashtests/crashtests.list
@ -74,6 +74,7 @@ HTTP load media-element-source-seek-1.html
 load offline-buffer-source-ended-1.html
 load oscillator-ended-1.html
 load oscillator-ended-2.html
+load 1080986.html
 include ../../mediasource/test/crashtests/crashtests.list

 # This needs to run at the end to avoid leaking busted state into other tests.
--- a/content/media/wave/WaveReader.cpp
+++ b/content/media/wave/WaveReader.cpp
@ -551,7 +551,7 @@ WaveReader::LoadListChunk(uint32_t aChunkSize,
  static_assert(uint64_t(MAX_CHUNK_SIZE) < UINT_MAX / sizeof(char),
                "MAX_CHUNK_SIZE too large for enumerator.");

-  if (aChunkSize > MAX_CHUNK_SIZE) {
+  if (aChunkSize > MAX_CHUNK_SIZE || aChunkSize < 4) {
    return false;
  }

@ -561,7 +561,7 @@ WaveReader::LoadListChunk(uint32_t aChunkSize,
  }

  static const uint32_t INFO_LIST_MAGIC = 0x494e464f;
-  const char *p = chunk.get();
+  const char* p = chunk.get();
  if (ReadUint32BE(&p) != INFO_LIST_MAGIC) {
    return false;
  }