Do proper bounds checking in formats (bug #1356)

git-svn-id: https://origsvn.digium.com/svn/asterisk/trunk@2694 65c4cc65-6c06-0410-ace0-fbb531ad65f3

diff --git a/formats/format_g729.c b/formats/format_g729.c
index 746c40b8a4d5f354e525e71ab2b870d09af4b40b..68dde216fd49f924156fa0ca20cce1e4df9082fd 100755 (executable)
--- a/formats/format_g729.c
+++ b/formats/format_g729.c
@@ -183,8 +183,9 @@ static int g729_seek(struct ast_filestream *fs, long sample_offset, int whence)
                offset = max - bytes;
        if (whence != SEEK_FORCECUR) {
                offset = (offset > max)?max:offset;
-               offset = (offset < min)?min:offset;
        }
+       // protect against seeking beyond begining.
+       offset = (offset < min)?min:offset;
        if (lseek(fs->fd, offset, SEEK_SET) < 0)
                return -1;
        return 0;

diff --git a/formats/format_gsm.c b/formats/format_gsm.c
index 4ac2b5a5dda430f4914be1cec7df7f08a416b6c7..d58039e6d26275960cdb859dd99156c3ee9f7a81 100755 (executable)
--- a/formats/format_gsm.c
+++ b/formats/format_gsm.c
@@ -197,9 +197,10 @@ static int gsm_seek(struct ast_filestream *fs, long sample_offset, int whence)
                offset = distance + cur;
        else if(whence == SEEK_END)
                offset = max - distance;
+       // Always protect against seeking past the begining.
+       offset = (offset < min)?min:offset;
        if (whence != SEEK_FORCECUR) {
                offset = (offset > max)?max:offset;
-               offset = (offset < min)?min:offset;
        } else if (offset > max) {
                int i;
                lseek(fs->fd, 0, SEEK_END);

diff --git a/formats/format_pcm.c b/formats/format_pcm.c
index a175f40aeb500e00baf05e4ac89bd80a7e6069c3..bc548992ba5c761ef67a4dec72b49740f42f666f 100755 (executable)
--- a/formats/format_pcm.c
+++ b/formats/format_pcm.c
@@ -172,8 +172,9 @@ static int pcm_seek(struct ast_filestream *fs, long sample_offset, int whence)
                offset = max - sample_offset;
        if (whence != SEEK_FORCECUR) {
                offset = (offset > max)?max:offset;
-               offset = (offset < min)?min:offset;
        }
+       // always protect against seeking past begining.
+       offset = (offset < min)?min:offset;
        return lseek(fs->fd, offset, SEEK_SET);
 }
 

diff --git a/formats/format_pcm_alaw.c b/formats/format_pcm_alaw.c
index 62103068d59639fc113cb20cfe20fe500bac3de1..db6b0c3d039789beafc1b0ffa1910ceddfa579a6 100755 (executable)
--- a/formats/format_pcm_alaw.c
+++ b/formats/format_pcm_alaw.c
@@ -253,8 +253,9 @@ static int pcm_seek(struct ast_filestream *fs, long sample_offset, int whence)
                offset = max - sample_offset;
        if (whence != SEEK_FORCECUR) {
                offset = (offset > max)?max:offset;
-               offset = (offset < min)?min:offset;
        }
+       // Always protect against seeking past begining
+       offset = (offset < min)?min:offset;
        return lseek(fs->fd, offset, SEEK_SET);
 }
 

diff --git a/formats/format_wav.c b/formats/format_wav.c
index dbca8ed50bf3c447d2a2fd5434b1449013cc384b..52f1508abd435a4bc2615e871cb053d64df56ec4 100755 (executable)
--- a/formats/format_wav.c
+++ b/formats/format_wav.c
@@ -525,8 +525,9 @@ static int wav_seek(struct ast_filestream *fs, long sample_offset, int whence)
                offset = max - samples;
         if (whence != SEEK_FORCECUR) {
                offset = (offset > max)?max:offset;
-               offset = (offset < min)?min:offset;
        }
+       // always protect the header space.
+       offset = (offset < min)?min:offset;
        return lseek(fs->fd,offset,SEEK_SET);
 }
 

diff --git a/formats/format_wav_gsm.c b/formats/format_wav_gsm.c
index 1d33caffb90956f99b70a2b7a5c2f69eb082eb20..6c988bdb8ed8e5b09b7ca1ea7aa20b02b62c2ea8 100755 (executable)
--- a/formats/format_wav_gsm.c
+++ b/formats/format_wav_gsm.c
@@ -493,8 +493,9 @@ static int wav_seek(struct ast_filestream *fs, long sample_offset, int whence)
                offset = distance + cur;
        else if(whence == SEEK_END)
                offset = max - distance;
+       // always protect against seeking past end of header
+       offset = (offset < min)?min:offset;
        if (whence != SEEK_FORCECUR) {
-               offset = (offset < min)?min:offset;
                offset = (offset > max)?max:offset;
        } else if (offset > max) {
                int i;