diff options
Diffstat (limited to 'src')
| -rw-r--r-- | src/file_xm.c | 34 |
1 files changed, 29 insertions, 5 deletions
diff --git a/src/file_xm.c b/src/file_xm.c index caf48c6..eda5fba 100644 --- a/src/file_xm.c +++ b/src/file_xm.c @@ -47,13 +47,16 @@ const file_hint_t file_hint_xm= { static int parse_patterns(file_recovery_t *fr, uint16_t patterns) { - while (patterns--) + for(; patterns!=0; patterns--) { uint32_t header_size; uint16_t data_size; if (fread(&header_size, 4, 1, fr->handle) != 1) return -1; +#if defined(__FRAMAC__) + Frama_C_make_unknown(&header_size, sizeof(header_size)); +#endif header_size = le32(header_size); log_debug("xm: pattern header of size %u\n", (unsigned int)header_size); @@ -67,25 +70,33 @@ static int parse_patterns(file_recovery_t *fr, uint16_t patterns) if (fread(&data_size, 2, 1, fr->handle) != 1) return -1; +#if defined(__FRAMAC__) + Frama_C_make_unknown(&data_size, sizeof(data_size)); +#endif data_size = le16(data_size); log_debug("xm: pattern data of size %u\n", data_size); if (fseek(fr->handle, data_size, SEEK_CUR) == -1) return -1; fr->file_size += (uint64_t)header_size+data_size; + if(fr->file_size > PHOTOREC_MAX_FILE_SIZE) + return -1; } return 0; } static int parse_instruments(file_recovery_t *fr, uint16_t instrs) { - while (instrs--) + for(; instrs!=0; instrs--) { uint16_t samples; uint32_t size; if (fread(&size, 4, 1, fr->handle) != 1) return -1; +#if defined(__FRAMAC__) + Frama_C_make_unknown(&size, sizeof(size)); +#endif size = le32(size); log_debug("xm: instrument header of size %u\n", (unsigned int)size); @@ -99,10 +110,15 @@ static int parse_instruments(file_recovery_t *fr, uint16_t instrs) if (fread(&samples, 2, 1, fr->handle) != 1) return -1; +#if defined(__FRAMAC__) + Frama_C_make_unknown(&samples, sizeof(samples)); +#endif samples = le16(samples); log_debug("xm: instrument with %u samples\n", samples); fr->file_size += size; + if(fr->file_size > PHOTOREC_MAX_FILE_SIZE) + return -1; /* Never seen any xm having anything but 263 when there are samples */ if (samples>0) { @@ -118,20 +134,24 @@ static int parse_instruments(file_recovery_t *fr, uint16_t instrs) return -1; - while (samples--) + for(; samples!=0; samples--) { if (fread(&size, 4, 1, fr->handle) != 1) return -1; - +#if defined(__FRAMAC__) + Frama_C_make_unknown(&size, sizeof(size)); +#endif size = le32(size); log_debug("xm: sample with length of %u\n", (unsigned int)size); /* Skip remaining of sample header * * @todo Verify that last 22 bytes are ASCII? */ - if (fseek(fr->handle, 36+size, SEEK_CUR) == -1) + if (fseek(fr->handle, (uint64_t)36+size, SEEK_CUR) == -1) return -1; fr->file_size += (uint64_t)40+size; + if(fr->file_size > PHOTOREC_MAX_FILE_SIZE) + return -1; } } /* No sample, account for garbage */ @@ -155,6 +175,10 @@ static void file_check_xm(file_recovery_t *fr) return; if (fread(&instrs, 2, 1, fr->handle) != 1) return; +#if defined(__FRAMAC__) + Frama_C_make_unknown(&patterns, sizeof(patterns)); + Frama_C_make_unknown(&instrs, sizeof(instrs)); +#endif instrs = le16(instrs); patterns = le16(patterns); |