gosu 1.1.1.1 → 1.4.1

data/dependencies/SDL_sound/libmodplug/load_it.c

@@ -9,27 +9,14 @@
 
 #include "libmodplug.h"
 
+static const
 BYTE autovibit2xm[8] =
 { 0, 3, 1, 4, 2, 0, 0, 0 };
 
-BYTE autovibxm2it[8] =
-{ 0, 2, 4, 1, 3, 0, 0, 0 };
-
 //////////////////////////////////////////////////////////
 // Impulse Tracker IT file support
 
-// for conversion of XM samples
-extern WORD XMPeriodTable[96+8];
-extern UINT XMLinearTable[768];
-
-static inline UINT ConvertVolParam(UINT value)
-//--------------------------------------------
-{
-	return (value > 9)  ? 9 : value;
-}
-
-
-BOOL CSoundFile_ITInstrToMPT(const void *p, INSTRUMENTHEADER *penv, UINT trkvers)
+static BOOL ITInstrToMPT(const void *p, INSTRUMENTHEADER *penv, UINT trkvers)
 //--------------------------------------------------------------------------------
 {
 	if (trkvers < 0x0200)
@@ -155,12 +142,13 @@ BOOL CSoundFile_ReadIT(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLengt
 	DWORD inspos[MAX_INSTRUMENTS];
 	DWORD smppos[MAX_SAMPLES];
 	DWORD patpos[MAX_PATTERNS];
-	BYTE chnmask[64], channels_used[64];
+	BYTE chnmask[64];//, channels_used[64]
 	MODCOMMAND lastvalue[64];
+	UINT j;
 
 	if ((!lpStream) || (dwMemLength < sizeof(ITFILEHEADER))) return FALSE;
 	ITFILEHEADER pifh;
-    SDL_memcpy(&pifh, lpStream, sizeof (pifh));
+	SDL_memcpy(&pifh, lpStream, sizeof(pifh));
 
 	pifh.id = bswapLE32(pifh.id);
 	pifh.reserved1 = bswapLE16(pifh.reserved1);
@@ -218,9 +206,8 @@ BOOL CSoundFile_ReadIT(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLengt
 	if (inspossize > MAX_INSTRUMENTS) inspossize = MAX_INSTRUMENTS;
 	inspossize <<= 2;
 	SDL_memcpy(inspos, lpStream+dwMemPos, inspossize);
-	for (UINT j=0; j < (inspossize>>2); j++)
-	{
-	       inspos[j] = bswapLE32(inspos[j]);
+	for (j=0; j < (inspossize>>2); j++) {
+	    inspos[j] = bswapLE32(inspos[j]);
 	}
 	dwMemPos += pifh.insnum * 4;
 	// Reading Samples Offsets
@@ -229,9 +216,8 @@ BOOL CSoundFile_ReadIT(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLengt
 	if (smppossize > MAX_SAMPLES) smppossize = MAX_SAMPLES;
 	smppossize <<= 2;
 	SDL_memcpy(smppos, lpStream+dwMemPos, smppossize);
-	for (UINT j=0; j < (smppossize>>2); j++)
-	{
-	       smppos[j] = bswapLE32(smppos[j]);
+	for (j=0; j < (smppossize>>2); j++) {
+	    smppos[j] = bswapLE32(smppos[j]);
 	}
 	dwMemPos += pifh.smpnum * 4;
 	// Reading Patterns Offsets
@@ -240,9 +226,8 @@ BOOL CSoundFile_ReadIT(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLengt
 	if (patpossize > MAX_PATTERNS) patpossize = MAX_PATTERNS;
 	patpossize <<= 2;
 	SDL_memcpy(patpos, lpStream+dwMemPos, patpossize);
-	for (UINT j=0; j < (patpossize>>2); j++)
-	{
-	       patpos[j] = bswapLE32(patpos[j]);
+	for (j=0; j < (patpossize>>2); j++) {
+	    patpos[j] = bswapLE32(patpos[j]);
 	}
 	dwMemPos += pifh.patnum * 4;
 	// Reading IT Extra Info
@@ -286,6 +271,8 @@ BOOL CSoundFile_ReadIT(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLengt
 		dwMemPos += 8;
 		if ((dwMemPos + len <= dwMemLength) && (len <= 64*MAX_CHANNELNAME))
 		{
+			const UINT n = len / MAX_CHANNELNAME;
+			if (n > _this->m_nChannels) _this->m_nChannels = n;
 			dwMemPos += len;
 		}
 	}
@@ -346,13 +333,13 @@ BOOL CSoundFile_ReadIT(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLengt
 	if (_this->m_nInstruments >= MAX_INSTRUMENTS) _this->m_nInstruments = MAX_INSTRUMENTS-1;
 	for (UINT nins=0; nins<_this->m_nInstruments; nins++)
 	{
-		if ((inspos[nins] > 0) && (inspos[nins] < dwMemLength - sizeof(ITOLDINSTRUMENT)))
+		if ((inspos[nins] > 0) && dwMemLength > sizeof(ITOLDINSTRUMENT) &&
+			(inspos[nins] < dwMemLength - sizeof(ITOLDINSTRUMENT)))
 		{
-			INSTRUMENTHEADER *penv = (INSTRUMENTHEADER *) SDL_malloc(sizeof (INSTRUMENTHEADER));
+			INSTRUMENTHEADER *penv = (INSTRUMENTHEADER *) SDL_calloc(1, sizeof (INSTRUMENTHEADER));
 			if (!penv) continue;
 			_this->Headers[nins+1] = penv;
-			SDL_memset(penv, 0, sizeof(INSTRUMENTHEADER));
-			CSoundFile_ITInstrToMPT(lpStream + inspos[nins], penv, pifh.cmwt);
+			ITInstrToMPT(lpStream + inspos[nins], penv, pifh.cmwt);
 		}
 	}
 	// Reading Samples
@@ -361,7 +348,7 @@ BOOL CSoundFile_ReadIT(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLengt
 	for (UINT nsmp=0; nsmp<pifh.smpnum; nsmp++) if ((smppos[nsmp]) && (smppos[nsmp] <= dwMemLength - sizeof(ITSAMPLESTRUCT)))
 	{
 		ITSAMPLESTRUCT pis;
-        SDL_memcpy(&pis, lpStream+smppos[nsmp], sizeof (pis));
+		SDL_memcpy(&pis, lpStream+smppos[nsmp], sizeof (pis));
 		pis.id = bswapLE32(pis.id);
 		pis.length = bswapLE32(pis.length);
 		pis.loopbegin = bswapLE32(pis.loopbegin);
@@ -487,7 +474,7 @@ BOOL CSoundFile_ReadIT(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLengt
 					if (note < 0x80) note++;
 					m[ch].note = note;
 					lastvalue[ch].note = note;
-					channels_used[ch] = TRUE;
+				//	channels_used[ch] = TRUE;
 				}
 			}
 			if (chnmask[ch] & 2)
@@ -567,19 +554,28 @@ BOOL CSoundFile_ReadIT(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLengt
 //////////////////////////////////////////////////////////////////////////////
 // IT 2.14 compression
 
-static DWORD ITReadBits(DWORD *bitbuf, UINT *bitnum, LPBYTE *_ibuf, CHAR n)
+static DWORD ITReadBits(DWORD *bitbuf, UINT *bitnum, LPBYTE *_ibuf, LPBYTE ibufend, CHAR n)
 //-----------------------------------------------------------------
 {
-    LPBYTE ibuf = *_ibuf;
+	LPBYTE ibuf = *_ibuf;
 	DWORD retval = 0;
 	UINT i = n;
 
+	// explicit if read 0 bits, then return 0
+	if (i == 0)
+		return(0);
+
 	if (n > 0)
 	{
 		do
 		{
 			if (!*bitnum)
 			{
+				if (ibuf >= ibufend)
+				{
+					*_ibuf = ibuf;
+					return 0;
+				}
 				*bitbuf = *ibuf++;
 				*bitnum = 8;
 			}
@@ -591,7 +587,7 @@ static DWORD ITReadBits(DWORD *bitbuf, UINT *bitnum, LPBYTE *_ibuf, CHAR n)
 		} while (i);
 		i = n;
 	}
-    *_ibuf = ibuf;
+	*_ibuf = ibuf;
 	return (retval >> (32-i));
 }
 
@@ -601,7 +597,8 @@ void ITUnpack8Bit(signed char *pSample, DWORD dwLen, LPBYTE lpMemFile, DWORD dwM
 {
 	signed char *pDst = pSample;
 	LPBYTE pSrc = lpMemFile;
-	DWORD wHdr = 0;
+	LPBYTE pStop = lpMemFile + dwMemLength;
+//	DWORD wHdr = 0;
 	DWORD wCount = 0;
 	DWORD bitbuf = 0;
 	UINT bitnum = 0;
@@ -612,7 +609,7 @@ void ITUnpack8Bit(signed char *pSample, DWORD dwLen, LPBYTE lpMemFile, DWORD dwM
 		if (!wCount)
 		{
 			wCount = 0x8000;
-			wHdr = bswapLE16(*((LPWORD)pSrc));
+		//	wHdr = bswapLE16(*((LPWORD)pSrc));
 			pSrc += 2;
 			bLeft = 9;
 			bTemp = bTemp2 = 0;
@@ -624,13 +621,13 @@ void ITUnpack8Bit(signed char *pSample, DWORD dwLen, LPBYTE lpMemFile, DWORD dwM
 		DWORD dwPos = 0;
 		do
 		{
-			WORD wBits = (WORD)ITReadBits(&bitbuf, &bitnum, &pSrc, bLeft);
+			WORD wBits = (WORD)ITReadBits(&bitbuf, &bitnum, &pSrc, pStop, bLeft);
 			if (bLeft < 7)
 			{
 				DWORD i = 1 << (bLeft-1);
 				DWORD j = wBits & 0xFFFF;
 				if (i != j) goto UnpackByte;
-				wBits = (WORD)(ITReadBits(&bitbuf, &bitnum, &pSrc, 3) + 1) & 0xFF;
+				wBits = (WORD)(ITReadBits(&bitbuf, &bitnum, &pSrc, pStop, 3) + 1) & 0xFF;
 				bLeft = ((BYTE)wBits < bLeft) ? (BYTE)wBits : (BYTE)((wBits+1) & 0xFF);
 				goto Next;
 			}
@@ -668,7 +665,7 @@ void ITUnpack8Bit(signed char *pSample, DWORD dwLen, LPBYTE lpMemFile, DWORD dwM
 		SkipByte:
 			dwPos++;
 		Next:
-			if (pSrc >= lpMemFile+dwMemLength+1) return;
+			if (pSrc >= pStop + 1) return;
 		} while (dwPos < d);
 		// Move On
 		wCount -= d;
@@ -683,7 +680,8 @@ void ITUnpack16Bit(signed char *pSample, DWORD dwLen, LPBYTE lpMemFile, DWORD dw
 {
 	signed short *pDst = (signed short *)pSample;
 	LPBYTE pSrc = lpMemFile;
-	DWORD wHdr = 0;
+	LPBYTE pStop = lpMemFile + dwMemLength;
+//	DWORD wHdr = 0;
 	DWORD wCount = 0;
 	DWORD bitbuf = 0;
 	UINT bitnum = 0;
@@ -695,7 +693,7 @@ void ITUnpack16Bit(signed char *pSample, DWORD dwLen, LPBYTE lpMemFile, DWORD dw
 		if (!wCount)
 		{
 			wCount = 0x4000;
-			wHdr = bswapLE16(*((LPWORD)pSrc));
+		//	wHdr = bswapLE16(*((LPWORD)pSrc));
 			pSrc += 2;
 			bLeft = 17;
 			wTemp = wTemp2 = 0;
@@ -707,13 +705,13 @@ void ITUnpack16Bit(signed char *pSample, DWORD dwLen, LPBYTE lpMemFile, DWORD dw
 		DWORD dwPos = 0;
 		do
 		{
-			DWORD dwBits = ITReadBits(&bitbuf, &bitnum, &pSrc, bLeft);
+			DWORD dwBits = ITReadBits(&bitbuf, &bitnum, &pSrc, pStop, bLeft);
 			if (bLeft < 7)
 			{
 				DWORD i = 1 << (bLeft-1);
 				DWORD j = dwBits;
 				if (i != j) goto UnpackByte;
-				dwBits = ITReadBits(&bitbuf, &bitnum, &pSrc, 4) + 1;
+				dwBits = ITReadBits(&bitbuf, &bitnum, &pSrc, pStop, 4) + 1;
 				bLeft = ((BYTE)(dwBits & 0xFF) < bLeft) ? (BYTE)(dwBits & 0xFF) : (BYTE)((dwBits+1) & 0xFF);
 				goto Next;
 			}
@@ -751,13 +749,13 @@ void ITUnpack16Bit(signed char *pSample, DWORD dwLen, LPBYTE lpMemFile, DWORD dw
 		SkipByte:
 			dwPos++;
 		Next:
-			if (pSrc >= lpMemFile+dwMemLength+1) return;
+			if (pSrc >= pStop + 1) return;
 		} while (dwPos < d);
 		// Move On
 		wCount -= d;
 		dwLen -= d;
 		pDst += d;
-		if (pSrc >= lpMemFile+dwMemLength) break;
+		if (pSrc >= pStop) break;
 	}
 }
 
@@ -770,7 +768,6 @@ UINT CSoundFile_LoadMixPlugins(CSoundFile *_this, const void *pData, UINT nLen)
 	while (nPos+8 < nLen)
 	{
 		DWORD nPluginSize;
-		UINT nPlugin;
 
 		nPluginSize = bswapLE32(*(DWORD *)(p+nPos+4));
 		if (nPluginSize > nLen-nPos-8) break;;
@@ -787,10 +784,9 @@ UINT CSoundFile_LoadMixPlugins(CSoundFile *_this, const void *pData, UINT nLen)
 			{
 				break;
 			}
-            // took out the (otherwise unused) plugin loading code here.  --ryan.
+			// took out the (otherwise unused) plugin loading code here.  --ryan.
 		}
 		nPos += nPluginSize + 8;
 	}
 	return nPos;
 }
-

data/dependencies/SDL_sound/libmodplug/load_mdl.c

@@ -39,7 +39,7 @@ typedef struct MDLPATTERNDATA
 } MDLPATTERNDATA;
 
 
-void ConvertMDLCommand(MODCOMMAND *m, UINT eff, UINT data)
+static void ConvertMDLCommand(MODCOMMAND *m, UINT eff, UINT data)
 //--------------------------------------------------------
 {
 	UINT command = 0, param = data;
@@ -88,19 +88,12 @@ void ConvertMDLCommand(MODCOMMAND *m, UINT eff, UINT data)
 }
 
 
-void UnpackMDLTrack(MODCOMMAND *pat, UINT nChannels, UINT nRows, UINT nTrack, const BYTE *lpTracks)
+static void UnpackMDLTrack(MODCOMMAND *pat, UINT nChannels, UINT nRows, UINT nTrack, const BYTE *lpTracks, UINT len)
 //-------------------------------------------------------------------------------------------------
 {
 	MODCOMMAND cmd, *m = pat;
-	UINT len = *((WORD *)lpTracks);
 	UINT pos = 0, row = 0, i;
-	lpTracks += 2;
-	for (UINT ntrk=1; ntrk<nTrack; ntrk++)
-	{
-		lpTracks += len;
-		len = *((WORD *)lpTracks);
-		lpTracks += 2;
-	}
+
 	cmd.note = cmd.instr = 0;
 	cmd.volcmd = cmd.vol = 0;
 	cmd.command = cmd.param = 0;
@@ -172,14 +165,12 @@ void UnpackMDLTrack(MODCOMMAND *pat, UINT nChannels, UINT nRows, UINT nTrack, co
 }
 
 
-
 BOOL CSoundFile_ReadMDL(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLength)
 //---------------------------------------------------------------
 {
 	DWORD dwMemPos, dwPos, blocklen, dwTrackPos;
 	const MDLSONGHEADER *pmsh = (const MDLSONGHEADER *)lpStream;
 	const MDLINFOBLOCK *pmib;
-	const MDLPATTERNDATA *pmpd;
 	UINT i,j, norders = 0, npatterns = 0, ntracks = 0;
 	UINT ninstruments = 0, nsamples = 0;
 	WORD block;
@@ -192,6 +183,7 @@ BOOL CSoundFile_ReadMDL(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 
 	if ((!lpStream) || (dwMemLength < 1024)) return FALSE;
 	if ((pmsh->id != 0x4C444D44) || ((pmsh->version & 0xF0) > 0x10)) return FALSE;
+	const UINT hdrLen = (pmsh->version>0)? 59 : 57;
 	SDL_memset(patterntracks, 0, sizeof(patterntracks));
 	SDL_memset(smpinfo, 0, sizeof(smpinfo));
 	SDL_memset(insvolenv, 0, sizeof(insvolenv));
@@ -203,10 +195,11 @@ BOOL CSoundFile_ReadMDL(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 	_this->m_nSamples = _this->m_nInstruments = 0;
 	while (dwMemPos+6 < dwMemLength)
 	{
-		block = *((WORD *)(lpStream+dwMemPos));
-		blocklen = *((DWORD *)(lpStream+dwMemPos+2));
+		const BYTE *pp = lpStream + dwMemPos;
+		block = pp[0] | (pp[1] << 8);
+		blocklen = pp[2] | (pp[3] << 8) | (pp[4] << 16) | (pp[5] << 24);
 		dwMemPos += 6;
-		if (dwMemPos + blocklen > dwMemLength)
+		if (blocklen > dwMemLength - dwMemPos)
 		{
 			if (dwMemPos == 11) return FALSE;
 			break;
@@ -215,9 +208,10 @@ BOOL CSoundFile_ReadMDL(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 		{
 		// IN: infoblock
 		case 0x4E49:
-			pmib = (MDLINFOBLOCK *)(lpStream+dwMemPos);
+			pmib = (const MDLINFOBLOCK *)(lpStream+dwMemPos);
 			norders = pmib->norders;
 			if (norders > MAX_ORDERS) norders = MAX_ORDERS;
+			if (blocklen < sizeof(MDLINFOBLOCK) + norders - sizeof(pmib->seq)) return FALSE;
 			_this->m_nRestartPos = pmib->repeatpos;
 			_this->m_nDefaultGlobalVolume = pmib->globalvol;
 			_this->m_nDefaultTempo = pmib->tempo;
@@ -244,29 +238,41 @@ BOOL CSoundFile_ReadMDL(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 			dwPos = dwMemPos + 1;
 			for (i=0; i<npatterns; i++)
 			{
-				if (dwPos+18 >= dwMemLength) break;
-				pmpd = (MDLPATTERNDATA *)(lpStream + dwPos);
-				if (pmpd->channels > 32) break;
-				_this->PatternSize[i] = pmpd->lastrow+1;
-				if (_this->m_nChannels < pmpd->channels) _this->m_nChannels = pmpd->channels;
-				dwPos += 18 + 2*pmpd->channels;
-				for (j=0; j<pmpd->channels; j++)
+				const BYTE *data;
+				UINT ch;
+				if (pmsh->version == 0) {
+					if (_this->m_nChannels < 32) _this->m_nChannels = 32;
+					ch = 32;
+				} else {
+					if (dwPos+18 >= dwMemLength) break;
+					const MDLPATTERNDATA *pmpd = (const MDLPATTERNDATA *)(lpStream + dwPos);
+					if (pmpd->channels > 32) break;
+					_this->PatternSize[i] = pmpd->lastrow+1;
+					if (_this->m_nChannels < pmpd->channels) _this->m_nChannels = pmpd->channels;
+					ch = pmpd->channels;
+				}
+
+				if (2 * ch >= dwMemLength - dwPos) break;
+				data = lpStream + dwPos;
+				dwPos += 2 * ch;
+				for (j=0; j<ch && j<_this->m_nChannels; j++, data+=2)
 				{
-					patterntracks[i*32+j] = pmpd->data[j];
+					patterntracks[i*32+j] = data[0] | (data[1] << 8);
 				}
 			}
 			break;
 		// TR: Track Data
 		case 0x5254:
 			if (dwTrackPos) break;
-			ntracks = *((WORD *)(lpStream+dwMemPos));
+			pp = lpStream + dwMemPos;
+			ntracks = pp[0] | (pp[1] << 8);
 			dwTrackPos = dwMemPos+2;
 			break;
 		// II: Instruments
 		case 0x4949:
 			ninstruments = lpStream[dwMemPos];
 			dwPos = dwMemPos+1;
-			for (i=0; i<ninstruments; i++)
+			for (i=0; dwPos+34<dwMemLength && i<ninstruments; i++)
 			{
 				UINT nins = lpStream[dwPos];
 				if ((nins >= MAX_INSTRUMENTS) || (!nins)) break;
@@ -274,11 +280,11 @@ BOOL CSoundFile_ReadMDL(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 				if (!_this->Headers[nins])
 				{
 					UINT note = 12;
-					if ((_this->Headers[nins] = (INSTRUMENTHEADER *) SDL_malloc(sizeof (INSTRUMENTHEADER))) == NULL) break;
+					if ((_this->Headers[nins] = (INSTRUMENTHEADER *) SDL_calloc(1, sizeof (INSTRUMENTHEADER))) == NULL) break;
 					INSTRUMENTHEADER *penv = _this->Headers[nins];
-					SDL_memset(penv, 0, sizeof(INSTRUMENTHEADER));
 					penv->nGlobalVol = 64;
 					penv->nPPC = 5*12;
+					if (34 + 14u*lpStream[dwPos+1] > dwMemLength - dwPos) break;
 					for (j=0; j<lpStream[dwPos+1]; j++)
 					{
 						const BYTE *ps = lpStream+dwPos+34+14*j;
@@ -318,50 +324,56 @@ BOOL CSoundFile_ReadMDL(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 			}
 			for (j=1; j<=_this->m_nInstruments; j++) if (!_this->Headers[j])
 			{
-				_this->Headers[j] = (INSTRUMENTHEADER *) SDL_malloc(sizeof (INSTRUMENTHEADER));
-				if (_this->Headers[j]) SDL_memset(_this->Headers[j], 0, sizeof(INSTRUMENTHEADER));
+				_this->Headers[j] = (INSTRUMENTHEADER *) SDL_calloc(1, sizeof (INSTRUMENTHEADER));
 			}
 			break;
 		// VE: Volume Envelope
 		case 0x4556:
-			if ((nvolenv = lpStream[dwMemPos]) == 0) break;
-			if (dwMemPos + nvolenv*32 + 1 <= dwMemLength) pvolenv = lpStream + dwMemPos + 1;
+			if (nvolenv || (nvolenv = lpStream[dwMemPos]) == 0) break;
+			if (dwMemPos + nvolenv*33 + 1 <= dwMemLength) pvolenv = lpStream + dwMemPos + 1;
 			break;
 		// PE: Panning Envelope
 		case 0x4550:
-			if ((npanenv = lpStream[dwMemPos]) == 0) break;
-			if (dwMemPos + npanenv*32 + 1 <= dwMemLength) ppanenv = lpStream + dwMemPos + 1;
+			if (npanenv || (npanenv = lpStream[dwMemPos]) == 0) break;
+			if (dwMemPos + npanenv*33 + 1 <= dwMemLength) ppanenv = lpStream + dwMemPos + 1;
 			break;
 		// FE: Pitch Envelope
 		case 0x4546:
-			if ((npitchenv = lpStream[dwMemPos]) == 0) break;
-			if (dwMemPos + npitchenv*32 + 1 <= dwMemLength) ppitchenv = lpStream + dwMemPos + 1;
+			if (npitchenv || (npitchenv = lpStream[dwMemPos]) == 0) break;
+			if (dwMemPos + npitchenv*33 + 1 <= dwMemLength) ppitchenv = lpStream + dwMemPos + 1;
 			break;
 		// IS: Sample Infoblock
 		case 0x5349:
 			nsamples = lpStream[dwMemPos];
+			i = blocklen / hdrLen;
+			if (i< nsamples) nsamples = i;
 			dwPos = dwMemPos+1;
-			for (i=0; i<nsamples; i++, dwPos += 59)
+			for (i=0; i<nsamples; i++, dwPos += hdrLen)
 			{
 				UINT nins = lpStream[dwPos];
 				if ((nins >= MAX_SAMPLES) || (!nins)) continue;
 				if (_this->m_nSamples < nins) _this->m_nSamples = nins;
 				MODINSTRUMENT *pins = &_this->Ins[nins];
-				pins->nC4Speed = *((DWORD *)(lpStream+dwPos+41));
-				pins->nLength = *((DWORD *)(lpStream+dwPos+45));
-				pins->nLoopStart = *((DWORD *)(lpStream+dwPos+49));
-				pins->nLoopEnd = pins->nLoopStart + *((DWORD *)(lpStream+dwPos+53));
+				pp = lpStream + dwPos + 41;
+				pins->nC4Speed = pp[0] | (pp[1] << 8); pp += 2;
+				if (pmsh->version > 0) {
+					pins->nC4Speed |= (pp[0] << 16) | (pp[1] << 24); pp += 2;
+				}
+				pins->nLength = pp[0] | (pp[1] << 8) | (pp[2] << 16) | (pp[3] << 24); pp += 4;
+				pins->nLoopStart = pp[0] | (pp[1] << 8) | (pp[2] << 16) | (pp[3] << 24); pp += 4;
+				pins->nLoopEnd = pins->nLoopStart + (pp[0] | (pp[1] << 8) | (pp[2] << 16) | (pp[3] << 24));
 				if (pins->nLoopEnd > pins->nLoopStart) pins->uFlags |= CHN_LOOP;
 				pins->nGlobalVol = 64;
-				if (lpStream[dwPos+58] & 0x01)
+				if (pmsh->version == 0) pins->nVolume = pp[4];
+				if (lpStream[dwPos+hdrLen-1] & 0x01)
 				{
 					pins->uFlags |= CHN_16BIT;
 					pins->nLength >>= 1;
 					pins->nLoopStart >>= 1;
 					pins->nLoopEnd >>= 1;
 				}
-				if (lpStream[dwPos+58] & 0x02) pins->uFlags |= CHN_PINGPONGLOOP;
-				smpinfo[nins] = (lpStream[dwPos+58] >> 2) & 3;
+				if (lpStream[dwPos+hdrLen-1] & 0x02) pins->uFlags |= CHN_PINGPONGLOOP;
+				smpinfo[nins] = (lpStream[dwPos+hdrLen-1] >> 2) & 3;
 			}
 			break;
 		// SA: Sample Data
@@ -371,17 +383,18 @@ BOOL CSoundFile_ReadMDL(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 			{
 				MODINSTRUMENT *pins = &_this->Ins[i];
 				UINT flags = (pins->uFlags & CHN_16BIT) ? RS_PCM16S : RS_PCM8S;
+				pp = lpStream + dwPos;
 				if (!smpinfo[i])
 				{
-					dwPos += CSoundFile_ReadSample(_this, pins, flags, (LPSTR)(lpStream+dwPos), dwMemLength - dwPos);
+					dwPos += CSoundFile_ReadSample(_this, pins, flags, (LPCSTR)pp, dwMemLength - dwPos);
 				} else
 				{
-					DWORD dwLen = *((DWORD *)(lpStream+dwPos));
+					DWORD dwLen = pp[0] | (pp[1] << 8) | (pp[2] << 16) | (pp[3] << 24); pp += 4;
 					dwPos += 4;
-					if ((dwLen < dwMemLength) && (dwLen <= dwMemLength - dwPos) && (dwLen > 4))
+					if ((dwLen <= dwMemLength) && (dwPos <= dwMemLength - dwLen) && (dwLen > 4))
 					{
 						flags = (pins->uFlags & CHN_16BIT) ? RS_MDL16 : RS_MDL8;
-						CSoundFile_ReadSample(_this, pins, flags, (LPSTR)(lpStream+dwPos), dwLen);
+						CSoundFile_ReadSample(_this, pins, flags, (LPCSTR)pp, dwLen);
 					}
 					dwPos += dwLen;
 				}
@@ -398,8 +411,24 @@ BOOL CSoundFile_ReadMDL(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 			if ((_this->Patterns[ipat] = CSoundFile_AllocatePattern(_this->PatternSize[ipat], _this->m_nChannels)) == NULL) break;
 			for (UINT chn=0; chn<_this->m_nChannels; chn++) if ((patterntracks[ipat*32+chn]) && (patterntracks[ipat*32+chn] <= ntracks))
 			{
+			    const BYTE *lpTracks = lpStream + dwTrackPos;
+			    UINT len = lpTracks[0] | (lpTracks[1] << 8);
+			    if (len < dwMemLength-dwTrackPos) {
 				MODCOMMAND *m = _this->Patterns[ipat] + chn;
-				UnpackMDLTrack(m, _this->m_nChannels, _this->PatternSize[ipat], patterntracks[ipat*32+chn], lpStream+dwTrackPos);
+				UINT nTrack = patterntracks[ipat*32+chn];
+
+				lpTracks += 2;
+				for (UINT ntrk=1; ntrk<nTrack && lpTracks + 1 < (dwMemLength + lpStream - len); ntrk++)
+				{
+					lpTracks += len;
+					len = lpTracks[0] | (lpTracks[1] << 8);
+					lpTracks += 2;
+				}
+
+				if ( len > dwMemLength - (lpTracks - lpStream) ) len = 0;
+
+				UnpackMDLTrack(m, _this->m_nChannels, _this->PatternSize[ipat], nTrack, lpTracks, len);
+			    }
 			}
 		}
 	}
@@ -472,7 +501,7 @@ BOOL CSoundFile_ReadMDL(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 WORD MDLReadBits(DWORD *bitbuf, UINT *bitnum, LPBYTE *_ibuf, CHAR n)
 //-----------------------------------------------------------------
 {
-    LPBYTE ibuf = *_ibuf;
+	LPBYTE ibuf = *_ibuf;
 	const WORD v = (WORD)(*bitbuf & ((1 << n) - 1) );
 	*bitbuf >>= n;
 	*bitnum -= n;
@@ -481,8 +510,6 @@ WORD MDLReadBits(DWORD *bitbuf, UINT *bitnum, LPBYTE *_ibuf, CHAR n)
 		*bitbuf |= (((DWORD)(*ibuf++)) << *bitnum);
 		*bitnum += 8;
 	}
-    *_ibuf = ibuf;
+	*_ibuf = ibuf;
 	return v;
 }
-
-

data/dependencies/SDL_sound/libmodplug/load_med.c

@@ -93,7 +93,7 @@ typedef struct tagMMD0SAMPLE
 typedef struct tagMMDSAMPLEHEADER
 {
 	DWORD length;     // length of *one* *unpacked* channel in *bytes*
-	WORD type;   
+	WORD type;
 				// if non-negative
 					// bits 0-3 reserved for multi-octave instruments, not supported on the PC
 					// 0x10: 16 bit (otherwise 8 bit)
@@ -165,7 +165,7 @@ typedef struct tagMMD2SONGHEADER
 	BYTE numsamples;	// # of samples (max 63)
 } MMD2SONGHEADER;
 
-// For MMD0 the note information is held in 3 bytes, byte0, byte1, byte2.  For reference we 
+// For MMD0 the note information is held in 3 bytes, byte0, byte1, byte2.  For reference we
 // number the bits in each byte 0..7, where 0 is the low bit.
 // The note is held as bits 5..0 of byte0
 // The instrument is encoded in 6 bits,  bits 7 and 6 of byte0 and bits 7,6,5,4 of byte1
@@ -238,7 +238,7 @@ typedef struct tagMMD0EXP
 	DWORD annotxt;
 	DWORD annolen;
 	DWORD iinfo;			// Instrument names
-	WORD i_ext_entries;	
+	WORD i_ext_entries;
 	WORD i_ext_entrsz;
 	DWORD jumpmask;
 	DWORD rgbtable;
@@ -576,11 +576,12 @@ BOOL CSoundFile_ReadMed(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 			}
 			UINT pseq = 0;
 			
-			if ((playseqtable) && (playseqtable < dwMemLength) && (nplayseq*4 < dwMemLength - playseqtable))
+			if ((playseqtable) && (playseqtable < dwMemLength) && (nplayseq*4 + 4 < dwMemLength - playseqtable))
 			{
 				pseq = bswapBE32(((LPDWORD)(lpStream+playseqtable))[nplayseq]);
 			}
-			if ((pseq) && (pseq < dwMemLength - sizeof(MMD2PLAYSEQ)))
+			if ((pseq) && dwMemLength > sizeof(MMD2PLAYSEQ) &&
+				(pseq < dwMemLength - sizeof(MMD2PLAYSEQ)))
 			{
 				const MMD2PLAYSEQ *pmps = (MMD2PLAYSEQ *)(lpStream + pseq);
 				UINT n = bswapBE16(pmps->length);
@@ -623,10 +624,11 @@ BOOL CSoundFile_ReadMed(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 		UINT len = bswapBE32(psdh->length);
 		if ((len > MAX_SAMPLE_LENGTH) || (dwPos + len + 6 > dwMemLength)) len = 0;
 		UINT flags = RS_PCM8S, stype = bswapBE16(psdh->type);
-		LPSTR psdata = (LPSTR)(lpStream + dwPos + 6);
+		dwPos += 6;
 		if (stype & 0x80)
 		{
-			psdata += (stype & 0x20) ? 14 : 6;
+			dwPos += (stype & 0x20) ? 14 : 6;
+			if (dwPos >= dwMemLength) continue;
 		} else
 		{
 			if (stype & 0x10)
@@ -641,11 +643,12 @@ BOOL CSoundFile_ReadMed(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 			if (stype & 0x20) len /= 2;
 		}
 		_this->Ins[iSmp+1].nLength = len;
-		CSoundFile_ReadSample(_this, &_this->Ins[iSmp+1], flags, psdata, dwMemLength - dwPos - 6);
+		CSoundFile_ReadSample(_this, &_this->Ins[iSmp+1], flags, (const char *)(lpStream + dwPos), dwMemLength - dwPos);
 	}
 	// Reading patterns (blocks)
 	if (wNumBlocks > MAX_PATTERNS) wNumBlocks = MAX_PATTERNS;
-	if ((!dwBlockArr) || (dwBlockArr > dwMemLength - 4*wNumBlocks)) return TRUE;
+	if ((!dwBlockArr) || (dwMemLength < 4*wNumBlocks) ||
+		(dwBlockArr > dwMemLength - 4*wNumBlocks)) return TRUE;
 	pdwTable = (LPDWORD)(lpStream + dwBlockArr);
 	playtransp += (version == '3') ? 24 : 48;
 	for (UINT iBlk=0; iBlk<wNumBlocks; iBlk++)
@@ -701,9 +704,15 @@ BOOL CSoundFile_ReadMed(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 				{
 					DWORD nameofs = bswapBE32(pbi->blockname);
 					UINT namelen = bswapBE32(pbi->blocknamelen);
-					if ((nameofs < dwMemLength) && (namelen < dwMemLength + nameofs))
+					if ((namelen < dwMemLength) && (nameofs < dwMemLength - namelen))
 					{
-						CSoundFile_SetPatternName(_this, iBlk, (LPCSTR)(lpStream+nameofs));
+						// SetPatternName expects a nul-terminated string.
+						char blockname[MAX_PATTERNNAME];
+						if (namelen >= MAX_PATTERNNAME) namelen = MAX_PATTERNNAME - 1;
+						SDL_memcpy(blockname, lpStream + nameofs, namelen);
+						blockname[namelen] = '\0';
+
+						CSoundFile_SetPatternName(_this, iBlk, blockname);
 					}
 				}
 				if (pbi->cmdexttable)
@@ -754,4 +763,3 @@ BOOL CSoundFile_ReadMed(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 	}
 	return TRUE;
 }
-