Bug 1287397 - Fix wave chunk size overflow; r=cpearce draft
authorAnthony Jones <ajones@mozilla.com>
Tue, 09 Aug 2016 13:34:58 +1200
changeset 398363 60f57edf43f7fb7c83b6db25dffb240993ec5523
parent 394995 ffac2798999c5b84f1b4605a1280994bb665a406
child 527642 8b270533ec8a3cfcca49de451e459521c4d35a1b
push id25508
push userajones@mozilla.com
push dateTue, 09 Aug 2016 01:35:25 +0000
reviewerscpearce
bugs1287397
milestone51.0a1
Bug 1287397 - Fix wave chunk size overflow; r=cpearce MozReview-Commit-ID: Dg1OT13urxe
dom/media/wave/WaveDemuxer.cpp
--- a/dom/media/wave/WaveDemuxer.cpp
+++ b/dom/media/wave/WaveDemuxer.cpp
@@ -108,18 +108,16 @@ WAVTrackDemuxer::Init()
   while (true) {
     if (!HeaderParserInit()) {
       return false;
     }
 
     uint32_t aChunkName = mHeaderParser.GiveHeader().ChunkName();
     uint32_t aChunkSize = mHeaderParser.GiveHeader().ChunkSize();
 
-    aChunkSize += aChunkSize % 2;
-
     if (aChunkName == FRMT_CODE) {
       if (!FmtChunkParserInit()) {
         return false;
       }
     } else if (aChunkName == LIST_CODE) {
       mHeaderParser.Reset();
       uint64_t endOfListChunk = static_cast<uint64_t>(mOffset) + aChunkSize;
       if (endOfListChunk > UINT32_MAX) {
@@ -130,17 +128,18 @@ WAVTrackDemuxer::Init()
       }
     } else if (aChunkName == DATA_CODE) {
       mDataLength = aChunkSize;
       if (mFirstChunkOffset != mOffset) {
         mFirstChunkOffset = mOffset;
       }
       break;
     } else {
-      mOffset += aChunkSize; // Skip other irrelevant chunks.
+      // Wave files are 2-byte aligned so we need to round up
+      mOffset += (aChunkSize + 1) & ~1; // Skip other irrelevant chunks.
     }
     mHeaderParser.Reset();
   }
 
   if (mDataLength > StreamLength() - mFirstChunkOffset) {
     mDataLength = StreamLength() - mFirstChunkOffset;
   }