Make sure that the Xing TOC starts with 0 and the entries are increasing over time...

Original commit message from CVS:
* ext/mad/gstmad.c: (mpg123_parse_xing_header):
* gst/mpegaudioparse/gstmpegaudioparse.c:
(gst_mp3parse_handle_first_frame):
Make sure that the Xing TOC starts with 0 and the entries
are increasing over time. Otherwise it's broken and should
be skipped. Fixes bug #507821.

diff --git a/ChangeLog b/ChangeLog
index db1cbca..cdf9da2 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,12 @@
+2008-01-08  Sebastian Dröge  <slomo@circular-chaos.org>
+
+       * ext/mad/gstmad.c: (mpg123_parse_xing_header):
+       * gst/mpegaudioparse/gstmpegaudioparse.c:
+       (gst_mp3parse_handle_first_frame):
+       Make sure that the Xing TOC starts with 0 and the entries
+       are increasing over time. Otherwise it's broken and should
+       be skipped. Fixes bug #507821.
+
 2008-01-08  Tim-Philipp Müller  <tim at centricular dot net>
 
        * gst/asfdemux/gstasfdemux.c: (asfdemux_dbg), (gst_asf_demux_reset),

diff --git a/ext/mad/gstmad.c b/ext/mad/gstmad.c
index 7f69a50..981de0f 100644 (file)
--- a/ext/mad/gstmad.c
+++ b/ext/mad/gstmad.c
@@ -1099,14 +1099,25 @@ mpg123_parse_xing_header (struct mad_header *header,
       ptr += 4;
     }
     if (xflags & XING_TOC_FLAG) {
+      guchar old = 0;
+
       lprintf ("toc found\n");
       if (ptr >= (buf + bufsize - XING_TOC_LENGTH))
         return 0;
+      if (*ptr != 0) {
+        lprintf ("skipping broken Xing TOC\n");
+        goto skip_toc;
+      }
       for (i = 0; i < XING_TOC_LENGTH; i++) {
         xtoc[i] = *(ptr + i);
+        if (old > xtoc[i]) {
+          lprintf ("skipping broken Xing TOC\n");
+          goto skip_toc;
+        }
         lprintf ("%d ", xtoc[i]);
       }
       lprintf ("\n");
+    skip_toc:
       ptr += XING_TOC_LENGTH;
     }
 

diff --git a/gst/mpegaudioparse/gstmpegaudioparse.c b/gst/mpegaudioparse/gstmpegaudioparse.c
index 69591ad..331a640 100644 (file)
--- a/gst/mpegaudioparse/gstmpegaudioparse.c
+++ b/gst/mpegaudioparse/gstmpegaudioparse.c
@@ -759,9 +759,23 @@ gst_mp3parse_handle_first_frame (GstMPEGAudioParse * mp3parse)
     if (xing_flags & XING_TOC_FLAG) {
       int i, percent = 0;
       guchar *table = mp3parse->xing_seek_table;
+      guchar old = 0;
+
+      if (data[0] != 0) {
+        GST_WARNING_OBJECT (mp3parse, "Skipping broken Xing TOC");
+        mp3parse->xing_flags &= ~XING_TOC_FLAG;
+        goto skip_toc;
+      }
 
       /* xing seek table: percent time -> 1/256 bytepos */
-      memcpy (mp3parse->xing_seek_table, data, 100);
+      for (i = 0; i < 100; i++) {
+        mp3parse->xing_seek_table[i] = data[i];
+        if (old > data[i]) {
+          GST_WARNING_OBJECT (mp3parse, "Skipping broken Xing TOC");
+          mp3parse->xing_flags &= ~XING_TOC_FLAG;
+          goto skip_toc;
+        }
+      }
 
       /* build inverse table: 1/256 bytepos -> 1/100 percent time */
       for (i = 0; i < 256; i++) {
@@ -788,6 +802,7 @@ gst_mp3parse_handle_first_frame (GstMPEGAudioParse * mp3parse)
           mp3parse->xing_seek_table_inverse[i] = (guint16) (fx * 100);
         }
       }
+    skip_toc:
       data += 100;
     } else {
       memset (mp3parse->xing_seek_table, 0, 100);