[MPG123] Update to version 1.25.12. CORE-16440

sdk/lib/3rdparty/libmpg123/id3.c

@@ -884,7 +884,8 @@ int parse_new_id3(mpg123_handle *fr, unsigned long first4bytes)
 								int rva_mode = -1; /* mix / album */
 								unsigned long realsize = framesize;
 								unsigned char* realdata = tagdata+pos;
-								if((flags & UNSYNC_FLAG) || (fflags & UNSYNC_FFLAG))
+								unsigned char* unsyncbuffer = NULL;
+								if(((flags & UNSYNC_FLAG) || (fflags & UNSYNC_FFLAG)) && framesize > 0)
 								{
 									unsigned long ipos = 0;
 									unsigned long opos = 0;
@@ -892,7 +893,7 @@ int parse_new_id3(mpg123_handle *fr, unsigned long first4bytes)
 									/* de-unsync: FF00 -> FF; real FF00 is simply represented as FF0000 ... */
 									/* damn, that means I have to delete bytes from withing the data block... thus need temporal storage */
 									/* standard mandates that de-unsync should always be safe if flag is set */
-									realdata = (unsigned char*) malloc(framesize); /* will need <= bytes */
+									realdata = unsyncbuffer = malloc(framesize+1); /* will need <= bytes, plus a safety zero */
 									if(realdata == NULL)
 									{
 										if(NOQUIET) error("ID3v2: unable to allocate working buffer for de-unsync");
@@ -909,6 +910,8 @@ int parse_new_id3(mpg123_handle *fr, unsigned long first4bytes)
 										}
 									}
 									realsize = opos;
+									/* Append a zero to keep strlen() safe. */
+									realdata[realsize] = 0;
 									debug2("ID3v2: de-unsync made %lu out of %lu bytes", realsize, framesize);
 								}
 								pos = 0; /* now at the beginning again... */
@@ -936,14 +939,24 @@ int parse_new_id3(mpg123_handle *fr, unsigned long first4bytes)
 										if(fr->rva.level[rva_mode] <= rva2+1)
 										{
 											pos += strlen((char*) realdata) + 1;
-											if(realdata[pos] == 1)
+											// channel and two bytes for RVA value
+											// pos possibly just past the safety zero, so one more than realsize
+											if(pos > realsize || realsize-pos < 3)
+											{
+												if(NOQUIET)
+													error("bad RVA2 tag (truncated?)");
+											}
+											else if(realdata[pos] == 1)
 											{
 												++pos;
 												/* only handle master channel */
 												debug("ID3v2: it is for the master channel");
 												/* two bytes adjustment, one byte for bits representing peak - n bytes, eh bits, for peak */
-												/* 16 bit signed integer = dB * 512  ... the double cast is needed to preserve the sign of negative values! */
-												fr->rva.gain[rva_mode] = (float) ( (((short)((signed char)realdata[pos])) << 8) | realdata[pos+1] ) / 512;
+												/* 16 bit signed integer = dB * 512. Do not shift signed integers! Multiply instead.
+												   Also no implementation-defined casting. Reinterpret the pointer to signed char, then do
+												   proper casting. */
+												fr->rva.gain[rva_mode] = (float) (
+													((short)((signed char*)realdata)[pos]) * 256 + (short)realdata[pos+1] ) / 512;
 												pos += 2;
 												if(VERBOSE3) fprintf(stderr, "Note: RVA value %fdB\n", fr->rva.gain[rva_mode]);
 												/* heh, the peak value is represented by a number of bits - but in what manner? Skipping that part */
@@ -964,7 +977,8 @@ int parse_new_id3(mpg123_handle *fr, unsigned long first4bytes)
 										break;
 									default: if(NOQUIET) error1("ID3v2: unknown frame type %i", tt);
 								}
-								if((flags & UNSYNC_FLAG) || (fflags & UNSYNC_FFLAG)) free(realdata);
+								if(unsyncbuffer)
+									free(unsyncbuffer);
 							}
 							#undef BAD_FFLAGS
 							#undef PRES_TAG_FFLAG

sdk/lib/3rdparty/libmpg123/parse.c

@@ -1063,18 +1063,29 @@ static int handle_apetag(mpg123_handle *fr, unsigned long newhead)
 	unsigned char apebuf[28];
 	unsigned long val;
 	int i, ret;
-
+	/* How many bytes to backpedal to get back to just after the first byte of */
+	/* the supposed header. */
+	int back_bytes = 3;
 	fr->oldhead = 0;
 
+	debug1("trying to read remaining APE header at %"OFF_P, (off_p)fr->rd->tell(fr));
 	/* Apetag headers are 32 bytes, newhead contains 4, read the rest */
-	if((ret=fr->rd->fullread(fr,apebuf,28)) < 0) return ret;
-
+	if((ret=fr->rd->fullread(fr,apebuf,28)) < 0)
+		return ret;
+	back_bytes += ret;
+	if(ret < 28)
+		goto apetag_bad;
+	
+	debug1("trying to parse APE header at %"OFF_P, (off_p)fr->rd->tell(fr));
 	/* Apetags start with "APETAGEX", "APET" is already tested. */
 	if(strncmp((char *)apebuf,"AGEX",4) != 0)
 		goto apetag_bad;
 
 	/* Version must be 2.000 / 2000 */
-	val = (apebuf[7]<<24)|(apebuf[6]<<16)|(apebuf[5]<<8)|apebuf[4];
+	val = ((unsigned long)apebuf[7]<<24)
+	|	((unsigned long)apebuf[6]<<16)
+	|	((unsigned long)apebuf[5]<<8)
+	|	apebuf[4];
 	if(val != 2000)
 		goto apetag_bad;
 
@@ -1084,14 +1095,22 @@ static int handle_apetag(mpg123_handle *fr, unsigned long newhead)
 			goto apetag_bad;
 
 	/* Looks good, skip the rest. */
-	val = (apebuf[11]<<24)|(apebuf[10]<<16)|(apebuf[9]<<8)|apebuf[8];
-	if((ret=fr->rd->skip_bytes(fr,val)) < 0) return ret;
+	val = ((unsigned long)apebuf[11]<<24)
+	|	((unsigned long)apebuf[10]<<16)
+	|	((unsigned long)apebuf[9]<<8)
+	|	apebuf[8];
+	debug2( "skipping %lu bytes of APE data at %"OFF_P
+	,	val, (off_p)fr->rd->tell(fr) );
+	/* If encountering EOF here, things are just at an end. */
+	if((ret=fr->rd->skip_bytes(fr,val)) < 0)
+		return ret;
 
 	return PARSE_AGAIN;
 
 apetag_bad:	
-	if(fr->rd->back_bytes(fr,31) < 0 && NOQUIET)
-		error("Cannot seek 31 bytes back!");
+	debug("no proper APE tag found, seeking back");
+	if(fr->rd->back_bytes(fr,back_bytes) < 0 && NOQUIET)
+		error1("Cannot seek %d bytes back!", back_bytes);
 
 	return PARSE_AGAIN; /* Give the resync code a chance to fix things */
 }