Bug 487519. Detect more Vorbis errors and propagate them out. rs=roc

media/libfishsound/README_MOZILLA

@@ -9,3 +9,5 @@ file names with other Mozilla libraries.
 The git commit id used was e98a05 from git://git.xiph.org/libfishsound.git
 
 endian.patch is applied to fix Bug 45269.
+
+bug487519.patch: Fixes for bug487519

media/libfishsound/bug487519.patch

@@ -0,0 +1,20 @@
+diff --git a/media/libfishsound/src/libfishsound/fishsound_vorbis.c b/media/libfishsound/src/libfishsound/fishsound_vorbis.c
+index 68bdb3a..236dda4 100644
+--- a/media/libfishsound/src/libfishsound/fishsound_vorbis.c
++++ b/media/libfishsound/src/libfishsound/fishsound_vorbis.c
+@@ -154,9 +154,13 @@ fs_vorbis_decode (FishSound * fsound, unsigned char * buf, long bytes)
+   } else {
+     FishSoundDecoded_FloatIlv df;
+     FishSoundDecoded_Float dfi;
+-
+-    if (vorbis_synthesis (&fsv->vb, &op) == 0)
++    int r;
++    if ((r = vorbis_synthesis (&fsv->vb, &op)) == 0) 
+       vorbis_synthesis_blockin (&fsv->vd, &fsv->vb);
++    
++    if (r == OV_EBADPACKET) {
++      return FISH_SOUND_ERR_GENERIC;
++    }
+ 
+     while ((samples = vorbis_synthesis_pcmout (&fsv->vd, &fsv->pcm)) > 0) {
+       vorbis_synthesis_read (&fsv->vd, samples);

media/libfishsound/src/libfishsound/fishsound_vorbis.c

@@ -154,9 +154,13 @@ fs_vorbis_decode (FishSound * fsound, unsigned char * buf, long bytes)
   } else {
     FishSoundDecoded_FloatIlv df;
     FishSoundDecoded_Float dfi;
-
-    if (vorbis_synthesis (&fsv->vb, &op) == 0)
+    int r;
+    if ((r = vorbis_synthesis (&fsv->vb, &op)) == 0) 
       vorbis_synthesis_blockin (&fsv->vd, &fsv->vb);
+    
+    if (r == OV_EBADPACKET) {
+      return FISH_SOUND_ERR_GENERIC;
+    }
 
     while ((samples = vorbis_synthesis_pcmout (&fsv->vd, &fsv->pcm)) > 0) {
       vorbis_synthesis_read (&fsv->vd, samples);

media/libfishsound/update.sh

@@ -39,3 +39,4 @@ cp $1/src/libfishsound/fs_vector.c ./src/libfishsound/fs_vector.c
 cp $1/src/libfishsound/convert.h ./src/libfishsound/convert.h
 cp $1/AUTHORS ./AUTHORS
 patch -p3 <endian.patch
+patch -p3 <bug487519.patch

media/liboggplay/README_MOZILLA

@@ -37,3 +37,5 @@ bug488951_fix_yuv_2: Additional fix to YUV conversion for odd height videos
 
 bug495129a.patch: Fix from liboggplay commit 6c8e11.
 bug495129b.patch: Fix from liboggplay commit 3602bf.
+
+bug487519.patch: Fix for bug 487519.

media/liboggplay/bug487519.patch

@@ -0,0 +1,19 @@
+diff --git a/media/liboggplay/src/liboggplay/oggplay_callback.c b/media/liboggplay/src/liboggplay/oggplay_callback.c
+index 428faee..344599a 100644
+--- a/media/liboggplay/src/liboggplay/oggplay_callback.c
++++ b/media/liboggplay/src/liboggplay/oggplay_callback.c
+@@ -388,7 +388,13 @@ oggplay_callback_audio (OGGZ * oggz, ogg_packet * op, long serialno,
+ 
+   fish_sound_prepare_truncation (decoder->sound_handle, op->granulepos,
+                                                                 op->e_o_s);
+-  fish_sound_decode (decoder->sound_handle, op->packet, op->bytes);
++  if (fish_sound_decode (decoder->sound_handle, op->packet, op->bytes) != 0) {
++    // Unrecoverable error, disable track
++    op->e_o_s = 1;
++    common->active = 0;
++    common->player->active_tracks--;
++    return OGGZ_ERR_HOLE_IN_DATA;
++  }
+ 
+   if (decoder->sound_info.channels == 0) {
+     fish_sound_command(decoder->sound_handle, FISH_SOUND_GET_INFO,

media/liboggplay/src/liboggplay/oggplay_callback.c

@@ -388,7 +388,13 @@ oggplay_callback_audio (OGGZ * oggz, ogg_packet * op, long serialno,
 
   fish_sound_prepare_truncation (decoder->sound_handle, op->granulepos,
                                                                 op->e_o_s);
-  fish_sound_decode (decoder->sound_handle, op->packet, op->bytes);
+  if (fish_sound_decode (decoder->sound_handle, op->packet, op->bytes) != 0) {
+    // Unrecoverable error, disable track
+    op->e_o_s = 1;
+    common->active = 0;
+    common->player->active_tracks--;
+    return OGGZ_ERR_HOLE_IN_DATA;
+  }
 
   if (decoder->sound_info.channels == 0) {
     fish_sound_command(decoder->sound_handle, FISH_SOUND_GET_INFO,

media/liboggplay/update.sh

@@ -58,3 +58,4 @@ patch -p3 < bug488951_yuv_fix.patch
 patch -p3 < bug488951_yuv_fix_2.patch
 patch -p3 < bug495129a.patch
 patch -p3 < bug495129b.patch
+patch -p3 < bug487519.patch

media/liboggz/README_MOZILLA

@@ -16,3 +16,5 @@ bounded_seek.patch is applied to fix bug 469408.
 key_frame_seek.patch fixes bug 463358.
 
 offset_next.patch fixes bug 495366.
+
+bug487519.patch: Fix for bug 487519.

media/liboggz/bug487519.patch

@@ -0,0 +1,156 @@
+diff --git a/media/liboggz/src/liboggz/oggz_dlist.c b/media/liboggz/src/liboggz/oggz_dlist.c
+index 7b26070..541563a 100644
+--- a/media/liboggz/src/liboggz/oggz_dlist.c
++++ b/media/liboggz/src/liboggz/oggz_dlist.c
+@@ -142,17 +142,23 @@ oggz_dlist_prepend(OggzDList *dlist, void *elem) {
+   return 0;
+ }
+ 
+-void
++int
+ oggz_dlist_iter(OggzDList *dlist, OggzDListIterFunc func) {
+ 
+   OggzDListElem *p;
+ 
+   for (p = dlist->head->next; p != dlist->tail; p = p->next) {
+-    if (func(p->data) == DLIST_ITER_CANCEL) {
++    int r = func(p->data);
++    if (r == DLIST_ITER_ERROR) {
++      return -1;
++    }
++
++    if (r == DLIST_ITER_CANCEL) {
+       break;
+     }
+   }
+ 
++  return 0;
+ }
+ 
+ void
+@@ -167,13 +173,19 @@ oggz_dlist_reverse_iter(OggzDList *dlist, OggzDListIterFunc func) {
+   }
+ }
+ 
+-void
++int
+ oggz_dlist_deliter(OggzDList *dlist, OggzDListIterFunc func) {
+ 
+   OggzDListElem *p, *q;
++  int result = 0;
+ 
+   for (p = dlist->head->next; p != dlist->tail; p = q) {
+-    if (func(p->data) == DLIST_ITER_CANCEL) {
++    int r = func(p->data);
++    if (r == DLIST_ITER_ERROR) {
++      result = -1;
++    }
++
++    if (r == DLIST_ITER_CANCEL) {
+       break;
+     }
+ 
+@@ -183,7 +195,7 @@ oggz_dlist_deliter(OggzDList *dlist, OggzDListIterFunc func) {
+ 
+     oggz_free(p);
+   }
+-
++  return result;
+ }
+ 
+ void
+@@ -195,7 +207,6 @@ oggz_dlist_reverse_deliter(OggzDList *dlist, OggzDListIterFunc func) {
+     if (func(p->data) == DLIST_ITER_CANCEL) {
+       break;
+     }
+-
+     q = p->prev;
+     p->prev->next = p->next;
+     p->next->prev = p->prev;
+diff --git a/media/liboggz/src/liboggz/oggz_dlist.h b/media/liboggz/src/liboggz/oggz_dlist.h
+index 8913e73..8955250 100644
+--- a/media/liboggz/src/liboggz/oggz_dlist.h
++++ b/media/liboggz/src/liboggz/oggz_dlist.h
+@@ -36,7 +36,7 @@
+ struct _OggzDList;
+ typedef struct _OggzDList OggzDList;
+ 
+-typedef enum {DLIST_ITER_CANCEL, DLIST_ITER_CONTINUE} OggzDListIterResponse;
++typedef enum {DLIST_ITER_ERROR=-1, DLIST_ITER_CANCEL=0, DLIST_ITER_CONTINUE=1} OggzDListIterResponse;
+ 
+ typedef OggzDListIterResponse (*OggzDListIterFunc) (void *elem);
+ 
+@@ -55,13 +55,13 @@ oggz_dlist_append(OggzDList *dlist, void *elem);
+ int
+ oggz_dlist_prepend(OggzDList *dlist, void *elem);
+ 
+-void
++int
+ oggz_dlist_iter(OggzDList *dlist, OggzDListIterFunc func);
+ 
+ void
+ oggz_dlist_reverse_iter(OggzDList *dlist, OggzDListIterFunc func);
+ 
+-void
++int
+ oggz_dlist_deliter(OggzDList *dlist, OggzDListIterFunc func);
+ 
+ void
+diff --git a/media/liboggz/src/liboggz/oggz_read.c b/media/liboggz/src/liboggz/oggz_read.c
+index 81eeb9e..98e25e8 100644
+--- a/media/liboggz/src/liboggz/oggz_read.c
++++ b/media/liboggz/src/liboggz/oggz_read.c
+@@ -295,11 +295,15 @@ oggz_read_deliver_packet(void *elem) {
+     oggz_get_unit (p->oggz, p->serialno, p->calced_granulepos);
+ 
+   if (p->stream->read_packet) {
+-    p->stream->read_packet(p->oggz, &(p->packet), p->serialno, 
+-            p->stream->read_user_data);
++    if (p->stream->read_packet(p->oggz, &(p->packet), p->serialno, 
++			       p->stream->read_user_data) != 0) {
++      return DLIST_ITER_ERROR;
++    }
+   } else if (p->reader->read_packet) {
+-    p->reader->read_packet(p->oggz, &(p->packet), p->serialno, 
+-            p->reader->read_user_data);
++    if (p->reader->read_packet(p->oggz, &(p->packet), p->serialno, 
++			       p->reader->read_user_data) != 0) {
++      return DLIST_ITER_ERROR;
++    }
+   }
+ 
+   p->reader->current_granulepos = gp_stored;
+@@ -455,7 +459,9 @@ oggz_read_sync (OGGZ * oggz)
+               ogg_int64_t gp_stored = stream->last_granulepos;
+               stream->last_packet = &packet;
+               oggz_dlist_reverse_iter(oggz->packet_buffer, oggz_read_update_gp);
+-              oggz_dlist_deliter(oggz->packet_buffer, oggz_read_deliver_packet);
++              if (oggz_dlist_deliter(oggz->packet_buffer, oggz_read_deliver_packet) == -1) {
++		return OGGZ_ERR_HOLE_IN_DATA;
++	      }
+ 
+               /*
+                * fix up the stream granulepos 
+@@ -493,7 +499,10 @@ oggz_read_sync (OGGZ * oggz)
+     }
+ 
+     /* If we've got a stop already, don't read more data in */
+-    if (cb_ret == OGGZ_STOP_OK || cb_ret == OGGZ_STOP_ERR) return cb_ret;
++    if (cb_ret == OGGZ_STOP_OK || 
++	cb_ret == OGGZ_STOP_ERR || 
++	cb_ret == OGGZ_ERR_HOLE_IN_DATA) 
++      return cb_ret;
+ 
+     if(oggz_read_get_next_page (oggz, &og) < 0)
+       return OGGZ_READ_EMPTY; /* eof. leave uninitialized */
+@@ -595,8 +604,9 @@ oggz_read (OGGZ * oggz, long n)
+       nread += bytes_read;
+       
+       cb_ret = oggz_read_sync (oggz);
+-      if (cb_ret == OGGZ_ERR_OUT_OF_MEMORY)
++      if (cb_ret == OGGZ_ERR_OUT_OF_MEMORY || cb_ret == OGGZ_ERR_HOLE_IN_DATA) {
+         return cb_ret;
++      }
+     }
+   }
+ 

media/liboggz/src/liboggz/oggz_dlist.c

@@ -142,17 +142,23 @@ oggz_dlist_prepend(OggzDList *dlist, void *elem) {
   return 0;
 }
 
-void
+int
 oggz_dlist_iter(OggzDList *dlist, OggzDListIterFunc func) {
 
   OggzDListElem *p;
 
   for (p = dlist->head->next; p != dlist->tail; p = p->next) {
-    if (func(p->data) == DLIST_ITER_CANCEL) {
+    int r = func(p->data);
+    if (r == DLIST_ITER_ERROR) {
+      return -1;
+    }
+
+    if (r == DLIST_ITER_CANCEL) {
       break;
     }
   }
 
+  return 0;
 }
 
 void
@@ -167,13 +173,19 @@ oggz_dlist_reverse_iter(OggzDList *dlist, OggzDListIterFunc func) {
   }
 }
 
-void
+int
 oggz_dlist_deliter(OggzDList *dlist, OggzDListIterFunc func) {
 
   OggzDListElem *p, *q;
+  int result = 0;
 
   for (p = dlist->head->next; p != dlist->tail; p = q) {
-    if (func(p->data) == DLIST_ITER_CANCEL) {
+    int r = func(p->data);
+    if (r == DLIST_ITER_ERROR) {
+      result = -1;
+    }
+
+    if (r == DLIST_ITER_CANCEL) {
       break;
     }
 
@@ -183,7 +195,7 @@ oggz_dlist_deliter(OggzDList *dlist, OggzDListIterFunc func) {
 
     oggz_free(p);
   }
-
+  return result;
 }
 
 void
@@ -195,7 +207,6 @@ oggz_dlist_reverse_deliter(OggzDList *dlist, OggzDListIterFunc func) {
     if (func(p->data) == DLIST_ITER_CANCEL) {
       break;
     }
-
     q = p->prev;
     p->prev->next = p->next;
     p->next->prev = p->prev;

media/liboggz/src/liboggz/oggz_dlist.h

@@ -36,7 +36,7 @@
 struct _OggzDList;
 typedef struct _OggzDList OggzDList;
 
-typedef enum {DLIST_ITER_CANCEL, DLIST_ITER_CONTINUE} OggzDListIterResponse;
+typedef enum {DLIST_ITER_ERROR=-1, DLIST_ITER_CANCEL=0, DLIST_ITER_CONTINUE=1} OggzDListIterResponse;
 
 typedef OggzDListIterResponse (*OggzDListIterFunc) (void *elem);
 
@@ -55,13 +55,13 @@ oggz_dlist_append(OggzDList *dlist, void *elem);
 int
 oggz_dlist_prepend(OggzDList *dlist, void *elem);
 
-void
+int
 oggz_dlist_iter(OggzDList *dlist, OggzDListIterFunc func);
 
 void
 oggz_dlist_reverse_iter(OggzDList *dlist, OggzDListIterFunc func);
 
-void
+int
 oggz_dlist_deliter(OggzDList *dlist, OggzDListIterFunc func);
 
 void

media/liboggz/src/liboggz/oggz_read.c

@@ -295,11 +295,15 @@ oggz_read_deliver_packet(void *elem) {
     oggz_get_unit (p->oggz, p->serialno, p->calced_granulepos);
 
   if (p->stream->read_packet) {
-    p->stream->read_packet(p->oggz, &(p->packet), p->serialno, 
-            p->stream->read_user_data);
+    if (p->stream->read_packet(p->oggz, &(p->packet), p->serialno, 
+			       p->stream->read_user_data) != 0) {
+      return DLIST_ITER_ERROR;
+    }
   } else if (p->reader->read_packet) {
-    p->reader->read_packet(p->oggz, &(p->packet), p->serialno, 
-            p->reader->read_user_data);
+    if (p->reader->read_packet(p->oggz, &(p->packet), p->serialno, 
+			       p->reader->read_user_data) != 0) {
+      return DLIST_ITER_ERROR;
+    }
   }
 
   p->reader->current_granulepos = gp_stored;
@@ -455,7 +459,9 @@ oggz_read_sync (OGGZ * oggz)
               ogg_int64_t gp_stored = stream->last_granulepos;
               stream->last_packet = &packet;
               oggz_dlist_reverse_iter(oggz->packet_buffer, oggz_read_update_gp);
-              oggz_dlist_deliter(oggz->packet_buffer, oggz_read_deliver_packet);
+              if (oggz_dlist_deliter(oggz->packet_buffer, oggz_read_deliver_packet) == -1) {
+		return OGGZ_ERR_HOLE_IN_DATA;
+	      }
 
               /*
                * fix up the stream granulepos 
@@ -493,7 +499,10 @@ oggz_read_sync (OGGZ * oggz)
     }
 
     /* If we've got a stop already, don't read more data in */
-    if (cb_ret == OGGZ_STOP_OK || cb_ret == OGGZ_STOP_ERR) return cb_ret;
+    if (cb_ret == OGGZ_STOP_OK || 
+	cb_ret == OGGZ_STOP_ERR || 
+	cb_ret == OGGZ_ERR_HOLE_IN_DATA) 
+      return cb_ret;
 
     if(oggz_read_get_next_page (oggz, &og) < 0)
       return OGGZ_READ_EMPTY; /* eof. leave uninitialized */
@@ -595,8 +604,9 @@ oggz_read (OGGZ * oggz, long n)
       nread += bytes_read;
       
       cb_ret = oggz_read_sync (oggz);
-      if (cb_ret == OGGZ_ERR_OUT_OF_MEMORY)
+      if (cb_ret == OGGZ_ERR_OUT_OF_MEMORY || cb_ret == OGGZ_ERR_HOLE_IN_DATA) {
         return cb_ret;
+      }
     }
   }
 

media/liboggz/update.sh

@@ -49,3 +49,4 @@ patch -p3 <endian.patch
 patch -p3 <bounded_seek.patch
 patch -p3 <key_frame_seek.patch
 patch -p3 <offset_next.patch
+patch -p3 <bug487519.patch

media/libvorbis/README_MOZILLA

@@ -11,3 +11,4 @@ support for builds with WINCE defined.
 
 BUG 469639 - Failed to build firefox trunk on OpenSolaris
 bug481601.patch is appled to fix bug 481601.
+bug487519.patch: fix for bug 487519.

media/libvorbis/bug487519.patch

@@ -0,0 +1,20 @@
+diff --git a/media/libvorbis/lib/vorbis_synthesis.c b/media/libvorbis/lib/vorbis_synthesis.c
+index 8872f57..b7b2399 100644
+--- a/media/libvorbis/lib/vorbis_synthesis.c
++++ b/media/libvorbis/lib/vorbis_synthesis.c
+@@ -43,9 +43,14 @@ int vorbis_synthesis(vorbis_block *vb,ogg_packet *op){
+ 
+   /* read our mode and pre/post windowsize */
+   mode=oggpack_read(opb,b->modebits);
+-  if(mode==-1)return(OV_EBADPACKET);
++  if(mode==-1) {
++    return(OV_EBADPACKET);
++  }
+   
+   vb->mode=mode;
++  if(!ci->mode_param[mode]) {
++    return(OV_EBADPACKET); 
++  }
+   vb->W=ci->mode_param[mode]->blockflag;
+   if(vb->W){
+ 

media/libvorbis/lib/vorbis_synthesis.c

@@ -43,9 +43,14 @@ int vorbis_synthesis(vorbis_block *vb,ogg_packet *op){
 
   /* read our mode and pre/post windowsize */
   mode=oggpack_read(opb,b->modebits);
-  if(mode==-1)return(OV_EBADPACKET);
+  if(mode==-1) {
+    return(OV_EBADPACKET);
+  }
   
   vb->mode=mode;
+  if(!ci->mode_param[mode]) {
+    return(OV_EBADPACKET); 
+  }
   vb->W=ci->mode_param[mode]->blockflag;
   if(vb->W){
 

media/libvorbis/update.sh

@@ -48,3 +48,4 @@ cp $1/README ./README
 cp $1/AUTHORS ./AUTHORS
 patch -p3 < ./alloca.diff
 patch -p3 <./bug481601.patch
+patch -p3 <bug487519.patch