[Gnash-commit] gnash ChangeLog server/swf/tag_loaders.cpp

[Sandro Santilli]

CVSROOT:        /sources/gnash
Module name:    gnash
Changes by:     Sandro Santilli <strk>  07/11/28 16:16:31

Modified files:
        .              : ChangeLog 
        server/swf     : tag_loaders.cpp 

Log message:
        (inflate_wrapper): don't read past end of tag, reads in chunks rather
        then byte-by-byte.  Fixes bug #21377.

CVSWeb URLs:
http://cvs.savannah.gnu.org/viewcvs/gnash/ChangeLog?cvsroot=gnash&r1=1.4995&r2=1.4996
http://cvs.savannah.gnu.org/viewcvs/gnash/server/swf/tag_loaders.cpp?cvsroot=gnash&r1=1.155&r2=1.156

Patches:
Index: ChangeLog
===================================================================
RCS file: /sources/gnash/gnash/ChangeLog,v
retrieving revision 1.4995
retrieving revision 1.4996
diff -u -b -r1.4995 -r1.4996
--- ChangeLog   28 Nov 2007 15:38:53 -0000      1.4995
+++ ChangeLog   28 Nov 2007 16:16:30 -0000      1.4996
@@ -1,5 +1,8 @@
 2007-11-28 Sandro Santilli <address@hidden>
 
+       * server/swf/tag_loaders.cpp (inflate_wrapper): don't read past
+         end of tag, reads in chunks rather then byte-by-byte.
+         Fixes bug #21377.
        * server/impl.cpp: stub support for png loading.
 
 2007-11-28 Sandro Santilli <address@hidden>

Index: server/swf/tag_loaders.cpp
===================================================================
RCS file: /sources/gnash/gnash/server/swf/tag_loaders.cpp,v
retrieving revision 1.155
retrieving revision 1.156
diff -u -b -r1.155 -r1.156
--- server/swf/tag_loaders.cpp  27 Nov 2007 23:36:13 -0000      1.155
+++ server/swf/tag_loaders.cpp  28 Nov 2007 16:16:30 -0000      1.156
@@ -17,7 +17,7 @@
 // Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
 //
 
-/* $Id: tag_loaders.cpp,v 1.155 2007/11/27 23:36:13 strk Exp $ */
+/* $Id: tag_loaders.cpp,v 1.156 2007/11/28 16:16:30 strk Exp $ */
 
 #ifdef HAVE_CONFIG_H
 #include "config.h"
@@ -346,14 +346,23 @@
        return;
     }
 
-    uint8_t buf[1];
+#define CHUNKSIZE 256
 
-    for (;;) {
-       // Fill a one-byte (!) buffer.
-       // TODO: sub-optimal, read_u8 also calls align needlessly
-       buf[0] = in.read_u8();
+    uint8_t buf[CHUNKSIZE];
+    unsigned long endTagPos = in.get_tag_end_position();
+
+    for (;;)
+    {
+       unsigned int chunkSize = CHUNKSIZE;
+       assert(in.get_position() <= endTagPos);
+        unsigned int availableBytes =  endTagPos - in.get_position();
+       if ( availableBytes < chunkSize ) chunkSize = availableBytes;
+       
+       // Fill the buffer
+       assert(sizeof(char) == sizeof(uint8_t));
+       in.read((char*)buf, chunkSize);
        d_stream.next_in = &buf[0];
-       d_stream.avail_in = 1;
+       d_stream.avail_in = chunkSize;
 
        err = inflate(&d_stream, Z_SYNC_FLUSH);
        if (err == Z_STREAM_END) break;