[OMPT-svn-commit] OpenMPT r22286 - in branches/OpenMPT-1.28: . soundlib

[<sv...@op...>]

Author: sagamusix
Date: Sun Nov 24 13:58:57 2024
New Revision: 22286
URL: https://source.openmpt.org/browse/openmpt/?op=revision&rev=22286

Log:
Merged revision(s) 22227 from trunk/OpenMPT:
[Fix] MMCMP: Avoid undefined shift behaviour when trying to read an arbitrary number of bits. Reject such malformed files like Ancient does.
........

Modified:
   branches/OpenMPT-1.28/   (props changed)
   branches/OpenMPT-1.28/soundlib/ContainerMMCMP.cpp

Modified: branches/OpenMPT-1.28/soundlib/ContainerMMCMP.cpp
==============================================================================
--- branches/OpenMPT-1.28/soundlib/ContainerMMCMP.cpp	Sun Nov 24 13:58:39 2024	(r22285)
+++ branches/OpenMPT-1.28/soundlib/ContainerMMCMP.cpp	Sun Nov 24 13:58:57 2024	(r22286)
@@ -264,6 +264,7 @@
 			if (pblk->flags & MMCMP_ABS16) Log("ABS16 ");
 			Log("\n");
 #endif
+			if(numbits > 15) return false;
 			if(!file.Seek(memPos + blk.tt_entries)) return false;
 			if(!file.CanRead(blk.pk_size - blk.tt_entries)) return false;
 			BitReader bitFile{ file.GetChunk(blk.pk_size - blk.tt_entries) };
@@ -341,6 +342,7 @@
 			uint32 numbits = blk.num_bits;
 			uint32 oldval = 0;
 			if(blk.tt_entries > sizeof(ptable)
+				|| numbits > 7
 				|| !file.Seek(memPos)
 				|| file.ReadRaw(ptable, blk.tt_entries) < blk.tt_entries)
 				return false;