commit 714e807aa538681472719e038f2741f5bff69a7c
author Maarten Lankhorst <crumb@google.com> Fri Mar 28 13:10:20 2008 -0700
committer Alexandre Julliard <julliard@winehq.org> Mon Mar 31 12:51:16 2008 +0200
tree ef10c4a442931a4f0300703f0aaa977c55243c96
parent ae1791b0b8d181e0d01f8db1cae4eba48edefbac

quartz: Check against a null dereference and don't read beyond the end of file.

dlls/quartz/mpegsplit.c

diff --git a/dlls/quartz/mpegsplit.c b/dlls/quartz/mpegsplit.c
index ab4d371..cb7528f 100644
--- a/dlls/quartz/mpegsplit.c
+++ b/dlls/quartz/mpegsplit.c
@@ -370,8 +370,12 @@
         FIXME("Failed with hres: %08x!\n", hr);
         This->skipbytes += This->remaining_bytes;
         This->remaining_bytes = 0;
-        IMediaSample_Release(This->pCurrentSample);
-        This->pCurrentSample = NULL;
+        if (This->pCurrentSample)
+        {
+            IMediaSample_SetActualDataLength(This->pCurrentSample, 0);
+            IMediaSample_Release(This->pCurrentSample);
+            This->pCurrentSample = NULL;
+        }
     }
 
     if (BYTES_FROM_MEDIATIME(tStop) >= This->EndOfFile)
@@ -647,6 +651,7 @@
             while (pos < This->EndOfFile && SUCCEEDED(hr))
             {
                 LONGLONG length = 0;
+                hr = IAsyncReader_SyncRead(pPin->pReader, pos, 4, header);
                 while (parse_header(header, &length, &duration))
                 {
                     /* No valid header yet; shift by a byte and check again */
@@ -655,11 +660,8 @@
                     if (FAILED(hr))
                        break;
                 }
-                if (SUCCEEDED(hr))
-                {
-                    pos += length;
-                    hr = IAsyncReader_SyncRead(pPin->pReader, pos, 4, header);
-                }
+                pos += length;
+                TRACE("Pos: %x%08x/%x%08x\n", (DWORD)(pos >> 32), (DWORD)pos, (DWORD)(This->EndOfFile>>32), (DWORD)This->EndOfFile);
             }
             hr = S_OK;
             TRACE("Duration: %d seconds\n", (DWORD)(duration / 10000000));