[Gnash-commit] gnash ChangeLog server/stream.cpp

[Benjamin Wolsey]

CVSROOT:        /sources/gnash
Module name:    gnash
Changes by:     Benjamin Wolsey <bwy>   08/06/03 17:57:45

Modified files:
        .              : ChangeLog 
        server         : stream.cpp 

Log message:
                * server/stream.cpp: always check return of read() to avoid 
reading
                  past the end of the stream; throw parser exception on failure.

CVSWeb URLs:
http://cvs.savannah.gnu.org/viewcvs/gnash/ChangeLog?cvsroot=gnash&r1=1.6794&r2=1.6795
http://cvs.savannah.gnu.org/viewcvs/gnash/server/stream.cpp?cvsroot=gnash&r1=1.51&r2=1.52

Patches:
Index: ChangeLog
===================================================================
RCS file: /sources/gnash/gnash/ChangeLog,v
retrieving revision 1.6794
retrieving revision 1.6795
diff -u -b -r1.6794 -r1.6795
--- ChangeLog   3 Jun 2008 17:38:31 -0000       1.6794
+++ ChangeLog   3 Jun 2008 17:57:44 -0000       1.6795
@@ -1,6 +1,8 @@
 2008-06-03 Benjamin Wolsey <address@hidden>
 
        * server/impl.cpp: indentation.
+       * server/stream.cpp: always check return of read() to avoid reading
+         past the end of the stream; throw parser exception on failure.
 
 2008-06-03 Sandro Santilli <address@hidden>
 

Index: server/stream.cpp
===================================================================
RCS file: /sources/gnash/gnash/server/stream.cpp,v
retrieving revision 1.51
retrieving revision 1.52
diff -u -b -r1.51 -r1.52
--- server/stream.cpp   6 May 2008 16:15:56 -0000       1.51
+++ server/stream.cpp   3 Jun 2008 17:57:44 -0000       1.52
@@ -70,10 +70,10 @@
        if ( ! _tagBoundsStack.empty() )
        {
                TagBoundaries& tb = _tagBoundsStack.back();
-               unsigned long end_pos = tb.second;
+        unsigned long endPos = tb.second;
                unsigned long cur_pos = get_position();
-               assert(end_pos >= cur_pos);
-               unsigned long left = end_pos - cur_pos;
+        assert(endPos >= cur_pos);
+        unsigned long left = endPos - cur_pos;
                if ( left < count ) count = left;
        }
 
@@ -184,7 +184,8 @@
 }
 
 
-int    stream::read_sint(unsigned short bitcount)
+int
+stream::read_sint(unsigned short bitcount)
 {
        //assert(bitcount <= 32); // already asserted in read_uint
 
@@ -287,7 +288,15 @@
 /// Read a 32bit (1:sign 8:exp 23:mantissa) floating point value
 float  stream::read_long_float()
 {
-       char data[4]; read(data, 4); // would align
+    const unsigned short dataLength = 4;
+
+    char data[dataLength];
+    
+    // Should align
+    if (read(data, dataLength) < dataLength)
+    {
+        throw ParserException(_("Unexpected end of stream while reading"));
+    }
        return convert_float_little(data); 
 }
 
@@ -300,16 +309,24 @@
 #else
        using boost::uint32_t;
 
-       unsigned char _buf[8]; read((char*)_buf, 8); // would align
-       uint64_t low = _buf[0];
-                low |= _buf[1] << 8;
-                low |= _buf[2] << 16;
-                low |= _buf[3] << 24;
-
-       uint64_t hi = _buf[4];
-                hi |= _buf[5] << 8;
-                hi |= _buf[6] << 16;
-                hi |= _buf[7] << 24;
+    const unsigned short dataLength = 8;
+    unsigned char buf[dataLength];
+    
+    // Should align:
+    if (read(reinterpret_cast<char*>(buf), dataLength) < dataLength)
+    {
+        throw ParserException(_("Unexpected end of stream while reading"));
+    }
+    
+    uint64_t low = buf[0];
+    low |= buf[1] << 8;
+    low |= buf[2] << 16;
+    low |= buf[3] << 24;
+
+    uint64_t hi = buf[4];
+    hi |= buf[5] << 8;
+    hi |= buf[6] << 16;
+    hi |= buf[7] << 24;
 
        return static_cast<long double> ( low | (hi<<32) );
 #endif
@@ -333,13 +350,18 @@
        align();
        return m_input->read_le16();
 #else
-       using boost::uint32_t;
+    const unsigned short dataLength = 2;
 
-       unsigned char _buf[2];
-       read((char*)_buf, 2); // would align
+    unsigned char buf[dataLength];
        
-       uint32_t result = _buf[0];
-                result |= (_buf[1] << 8);
+    // Should align:
+    if (read(reinterpret_cast<char*>(buf), dataLength) < dataLength)
+    {
+        throw ParserException(_("Unexpected end of stream while reading"));
+    }
+    
+    boost::uint32_t result = buf[0];
+    result |= (buf[1] << 8);
 
        return result;
 #endif
@@ -359,11 +381,20 @@
 #else
        using boost::uint32_t;
 
-       unsigned char _buf[4]; read((char*)_buf, 4); // would align
-       uint32_t result = _buf[0];
-                result |= _buf[1] << 8;
-                result |= _buf[2] << 16;
-                result |= _buf[3] << 24;
+    const unsigned short dataLength = 4;
+
+    unsigned char buf[dataLength];
+    
+    // Should align
+    if (read(reinterpret_cast<char*>(buf), dataLength) < dataLength)
+    {
+        throw ParserException(_("Unexpected end of stream while reading"));
+    }
+    
+    uint32_t result = buf[0];
+         result |= buf[1] << 8;
+         result |= buf[2] << 16;
+         result |= buf[3] << 24;
 
        return result;
 #endif
@@ -385,9 +416,9 @@
        do
        {
                ensureBytes(1);
-               char c = read_u8();
-               if ( c == 0 ) break; // don't store a NULL in the string..
-               to += c;
+        const char& c = read_u8();
+        if ( c == 0 ) break; // don't store a NULL in the string.
+        to.push_back(c);
        } while(1);
 
 }
@@ -397,7 +428,7 @@
        align();
 
        ensureBytes(1);
-       unsigned int    len = read_u8();
+    const unsigned int len = read_u8();
        read_string_with_length(len, to); // will check 'len'
 }
 
@@ -410,13 +441,14 @@
        ensureBytes(len);
        for (unsigned int i = 0; i < len; ++i)
        {
-               to[i] = read_u8();
+        to.push_back(read_u8());
        }
 
 }
 
 
-unsigned long stream::get_position()
+unsigned long
+stream::get_position()
 {
        int pos = m_input->get_position();
        // TODO: check return value? Could be negative.
@@ -424,7 +456,8 @@
 }
 
 
-bool   stream::set_position(unsigned long pos)
+bool
+stream::set_position(unsigned long pos)
 {
        align();
 
@@ -432,16 +465,16 @@
        if ( ! _tagBoundsStack.empty() )
        {
                TagBoundaries& tb = _tagBoundsStack.back();
-               unsigned long end_pos = tb.second;
-               if ( pos > end_pos )
+        unsigned long endPos = tb.second;
+        if ( pos > endPos )
                {
                        log_error("Attempt to seek past the end of an opened 
tag");
                        // abort(); // ?
                        // throw ParserException ?
                        return false;
                }
-               unsigned long start_pos = tb.first;
-               if ( pos < start_pos )
+        unsigned long startPos = tb.first;
+        if ( pos < startPos )
                {
                        log_error("Attempt to seek before start of an opened 
tag");
                        // abort(); // ?
@@ -464,7 +497,8 @@
 }
 
 
-unsigned long stream::get_tag_end_position()
+unsigned long
+stream::get_tag_end_position()
 {
        assert(_tagBoundsStack.size() > 0);
 
@@ -552,15 +586,18 @@
 void
 stream::close_tag()
 {
+
     assert(_tagBoundsStack.size() > 0);
-    unsigned long end_pos = _tagBoundsStack.back().second;
+    unsigned long endPos = _tagBoundsStack.back().second;
     _tagBoundsStack.pop_back();
 
-    if ( m_input->set_position(end_pos) == TU_FILE_SEEK_ERROR )
+    log_debug("Close tag called at %d, stream size: %d", endPos);
+
+    if ( m_input->set_position(endPos) == TU_FILE_SEEK_ERROR )
     {
         // We'll go on reading right past the end of the stream
         // if we don't throw an exception.
-        throw ParserException(_("Could not seek to end position"));
+        throw ParserException(_("Could not seek to reported end of tag"));
     }
 
     m_unused_bits = 0;