gosu 1.4.1 → 1.4.3

data/dependencies/SDL_sound/libmodplug/fastmix.c

@@ -8,6 +8,11 @@
 #include "libmodplug.h"
 #include <math.h>
 
+#include "SDL_stdinc.h"
+#if !(defined(HAVE_LIBC) && defined(__WATCOMC__)) /* Watcom has issues... */
+#define floor SDL_floor
+#endif
+
 /*
  *-----------------------------------------------------------------------------
  cubic spline interpolation doc,

data/dependencies/SDL_sound/libmodplug/load_669.c

@@ -16,7 +16,7 @@
 typedef struct tagFILEHEADER669
 {
 	WORD sig;				// 'if' or 'JN'
-	signed char songmessage[108];	// Song Message
+	char songmessage[108];			// Song Message
 	BYTE samples;			// number of samples (1-64)
 	BYTE patterns;			// number of patterns (1-128)
 	BYTE restartpos;

data/dependencies/SDL_sound/libmodplug/load_amf.c

@@ -292,6 +292,7 @@ BOOL CSoundFile_ReadAMF(CSoundFile *_this, LPCBYTE lpStream, const DWORD dwMemLe
 	// Setup sequence list
 	for (UINT iOrd=0; iOrd<MAX_ORDERS; iOrd++)
 	{
+		if (dwMemPos + 4 > dwMemLength) return TRUE;
 		_this->Order[iOrd] = 0xFF;
 		if (iOrd < pfh->numorders)
 		{

data/dependencies/SDL_sound/libmodplug/load_ams.c

@@ -138,6 +138,13 @@ BOOL CSoundFile_ReadAMS(CSoundFile *_this, LPCBYTE lpStream, DWORD dwMemLength)
 		while ((row < _this->PatternSize[iPat]) && (i+2 < len))
 		{
 			BYTE b0 = p[i++];
+
+			if (b0 == 0xff)
+			{
+				row++;
+				continue;
+			}
+
 			BYTE b1 = p[i++];
 			BYTE b2 = 0;
 			UINT ch = b0 & 0x3F;
@@ -467,40 +474,49 @@ BOOL CSoundFile_ReadAMS2(CSoundFile *_this, LPCBYTE lpStream, DWORD dwMemLength)
 			{
 				MODCOMMAND *m = _this->Patterns[ipat] + row * _this->m_nChannels;
 				UINT byte1 = psrc[pos++];
+				UINT byte2;
 				UINT ch = byte1 & 0x1F;
+				if (byte1 == 0xff)
+				{
+					row++;
+					continue;
+				}
+
 				// Read Note + Instr
 				if (!(byte1 & 0x40))
 				{
-					UINT byte2 = psrc[pos++];
+					byte2 = psrc[pos++];
 					UINT note = byte2 & 0x7F;
 					if (note) m[ch].note = (note > 1) ? (note-1) : 0xFF;
 					m[ch].instr = psrc[pos++];
-					// Read Effect
-					while (byte2 & 0x80)
+				} else {
+					byte2 = 0x80; /* row contains atleast one effect, so trigged the first parse */
+				}
+				// Read Effect
+				while (byte2 & 0x80)
+				{
+					byte2 = psrc[pos++];
+					if (byte2 & 0x40)
 					{
-						byte2 = psrc[pos++];
-						if (byte2 & 0x40)
+						m[ch].volcmd = VOLCMD_VOLUME;
+						m[ch].vol = byte2 & 0x3F;
+					} else
+					{
+						UINT command = byte2 & 0x3F;
+						UINT param = psrc[pos++];
+						if (command == 0x0C)
 						{
 							m[ch].volcmd = VOLCMD_VOLUME;
-							m[ch].vol = byte2 & 0x3F;
+							m[ch].vol = param / 2;
 						} else
+						if (command < 0x10)
 						{
-							UINT command = byte2 & 0x3F;
-							UINT param = psrc[pos++];
-							if (command == 0x0C)
-							{
-								m[ch].volcmd = VOLCMD_VOLUME;
-								m[ch].vol = param / 2;
-							} else
-							if (command < 0x10)
-							{
-								m[ch].command = command;
-								m[ch].param = param;
-								CSoundFile_ConvertModCommand(_this, &m[ch]);
-							} else
-							{
-								// TODO: AMS effects
-							}
+							m[ch].command = command;
+							m[ch].param = param;
+							CSoundFile_ConvertModCommand(_this, &m[ch]);
+						} else
+						{
+							// TODO: AMS effects
 						}
 					}
 				}

data/dependencies/SDL_sound/libmodplug/load_it.c

@@ -393,16 +393,16 @@ BOOL CSoundFile_ReadIT(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLengt
 				if (pis.flags & 2)
 				{
 					flags += 5;
-					if (pis.flags & 4) flags |= RSF_STEREO;
 					pins->uFlags |= CHN_16BIT;
 					// IT 2.14 16-bit packed sample ?
 					if (pis.flags & 8) flags = ((pifh.cmwt >= 0x215) && (pis.cvt & 4)) ? RS_IT21516 : RS_IT21416;
+					if (pis.flags & 4) flags |= RSF_STEREO;
 				} else
 				{
-					if (pis.flags & 4) flags |= RSF_STEREO;
 					if (pis.cvt == 0xFF) flags = RS_ADPCM4; else
 					// IT 2.14 8-bit packed sample ?
 					if (pis.flags & 8)	flags =	((pifh.cmwt >= 0x215) && (pis.cvt & 4)) ? RS_IT2158 : RS_IT2148;
+					if (pis.flags & 4) flags |= RSF_STEREO;
 				}
 				CSoundFile_ReadSample(_this, &_this->Ins[nsmp+1], flags, (LPSTR)(lpStream+pis.samplepointer), dwMemLength - pis.samplepointer);
 			}
@@ -592,12 +592,13 @@ static DWORD ITReadBits(DWORD *bitbuf, UINT *bitnum, LPBYTE *_ibuf, LPBYTE ibufe
 }
 
 #define IT215_SUPPORT
-void ITUnpack8Bit(signed char *pSample, DWORD dwLen, LPBYTE lpMemFile, DWORD dwMemLength, BOOL b215)
-//-------------------------------------------------------------------------------------------
+DWORD ITUnpack8Bit(signed char *pSample, DWORD dwLen, LPBYTE lpMemFile, DWORD dwMemLength, DWORD channels, BOOL b215)
+//-------------------------------------------------------------------------------------------------------------------
 {
 	signed char *pDst = pSample;
 	LPBYTE pSrc = lpMemFile;
 	LPBYTE pStop = lpMemFile + dwMemLength;
+	DWORD writePos = 0;
 //	DWORD wHdr = 0;
 	DWORD wCount = 0;
 	DWORD bitbuf = 0;
@@ -658,29 +659,31 @@ void ITUnpack8Bit(signed char *pSample, DWORD dwLen, LPBYTE lpMemFile, DWORD dwM
 			bTemp = (BYTE)wBits;
 			bTemp2 += bTemp;
 #ifdef IT215_SUPPORT
-			pDst[dwPos] = (b215) ? bTemp2 : bTemp;
+			pDst[writePos] = (b215) ? bTemp2 : bTemp;
 #else
-			pDst[dwPos] = bTemp;
+			pDst[writePos] = bTemp;
 #endif
 		SkipByte:
 			dwPos++;
+			writePos += channels;
 		Next:
-			if (pSrc >= pStop + 1) return;
+			if (pSrc >= pStop + 1) return (DWORD)(pSrc - lpMemFile);
 		} while (dwPos < d);
 		// Move On
 		wCount -= d;
 		dwLen -= d;
-		pDst += d;
 	}
+	return (DWORD)(pSrc - lpMemFile);
 }
 
 
-void ITUnpack16Bit(signed char *pSample, DWORD dwLen, LPBYTE lpMemFile, DWORD dwMemLength, BOOL b215)
-//--------------------------------------------------------------------------------------------
+DWORD ITUnpack16Bit(signed char *pSample, DWORD dwLen, LPBYTE lpMemFile, DWORD dwMemLength, DWORD channels, BOOL b215)
+//--------------------------------------------------------------------------------------------------------------------
 {
 	signed short *pDst = (signed short *)pSample;
 	LPBYTE pSrc = lpMemFile;
 	LPBYTE pStop = lpMemFile + dwMemLength;
+	DWORD writePos = 0;
 //	DWORD wHdr = 0;
 	DWORD wCount = 0;
 	DWORD bitbuf = 0;
@@ -742,21 +745,22 @@ void ITUnpack16Bit(signed char *pSample, DWORD dwLen, LPBYTE lpMemFile, DWORD dw
 			wTemp = (signed short)dwBits;
 			wTemp2 += wTemp;
 #ifdef IT215_SUPPORT
-			pDst[dwPos] = (b215) ? wTemp2 : wTemp;
+			pDst[writePos] = (b215) ? wTemp2 : wTemp;
 #else
-			pDst[dwPos] = wTemp;
+			pDst[writePos] = wTemp;
 #endif
 		SkipByte:
 			dwPos++;
+			writePos += channels;
 		Next:
-			if (pSrc >= pStop + 1) return;
+			if (pSrc >= pStop + 1) return (DWORD)(pSrc - lpMemFile);
 		} while (dwPos < d);
 		// Move On
 		wCount -= d;
 		dwLen -= d;
-		pDst += d;
 		if (pSrc >= pStop) break;
 	}
+	return (DWORD)(pSrc - lpMemFile);
 }
 
 UINT CSoundFile_LoadMixPlugins(CSoundFile *_this, const void *pData, UINT nLen)

data/dependencies/SDL_sound/libmodplug/load_mdl.c

@@ -122,17 +122,17 @@ static void UnpackMDLTrack(MODCOMMAND *pat, UINT nChannels, UINT nRows, UINT nTr
 
 		case 0x03:
 			{
-				cmd.note = (xx & 0x01) ? lpTracks[pos++] : 0;
-				cmd.instr = (xx & 0x02) ? lpTracks[pos++] : 0;
+				cmd.note = (xx & 0x01) ? (pos < len ? lpTracks[pos++] : 0) : 0;
+				cmd.instr = (xx & 0x02) ? (pos < len ? lpTracks[pos++] : 0) : 0;
 				cmd.volcmd = cmd.vol = 0;
 				cmd.command = cmd.param = 0;
 				if ((cmd.note < NOTE_MAX-12) && (cmd.note)) cmd.note += 12;
-				UINT volume = (xx & 0x04) ? lpTracks[pos++] : 0;
-				UINT commands = (xx & 0x08) ? lpTracks[pos++] : 0;
+				UINT volume = (xx & 0x04) ? (pos < len ? lpTracks[pos++] : 0) : 0;
+				UINT commands = (xx & 0x08) ? (pos < len ? lpTracks[pos++] : 0) : 0;
 				UINT command1 = commands & 0x0F;
 				UINT command2 = commands & 0xF0;
-				UINT param1 = (xx & 0x10) ? lpTracks[pos++] : 0;
-				UINT param2 = (xx & 0x20) ? lpTracks[pos++] : 0;
+				UINT param1 = (xx & 0x10) ? (pos < len ? lpTracks[pos++] : 0) : 0;
+				UINT param2 = (xx & 0x20) ? (pos < len ? lpTracks[pos++] : 0) : 0;
 				if ((command1 == 0x0E) && ((param1 & 0xF0) == 0xF0) && (!command2))
 				{
 					param1 = ((param1 & 0x0F) << 8) | param2;
@@ -208,6 +208,7 @@ BOOL CSoundFile_ReadMDL(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 		{
 		// IN: infoblock
 		case 0x4E49:
+			if (blocklen < sizeof(MDLINFOBLOCK)) break;
 			pmib = (const MDLINFOBLOCK *)(lpStream+dwMemPos);
 			norders = pmib->norders;
 			if (norders > MAX_ORDERS) norders = MAX_ORDERS;
@@ -263,6 +264,7 @@ BOOL CSoundFile_ReadMDL(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 			break;
 		// TR: Track Data
 		case 0x5254:
+			if (blocklen < 2) break;
 			if (dwTrackPos) break;
 			pp = lpStream + dwMemPos;
 			ntracks = pp[0] | (pp[1] << 8);
@@ -272,7 +274,9 @@ BOOL CSoundFile_ReadMDL(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 		case 0x4949:
 			ninstruments = lpStream[dwMemPos];
 			dwPos = dwMemPos+1;
-			for (i=0; dwPos+34<dwMemLength && i<ninstruments; i++)
+			if (blocklen < sizeof(INSTRUMENTHEADER)*ninstruments + 1) break;
+
+			for (i=0; i<ninstruments; i++)
 			{
 				UINT nins = lpStream[dwPos];
 				if ((nins >= MAX_INSTRUMENTS) || (!nins)) break;
@@ -282,6 +286,7 @@ BOOL CSoundFile_ReadMDL(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 					UINT note = 12;
 					if ((_this->Headers[nins] = (INSTRUMENTHEADER *) SDL_calloc(1, sizeof (INSTRUMENTHEADER))) == NULL) break;
 					INSTRUMENTHEADER *penv = _this->Headers[nins];
+					if (dwPos > dwMemLength - 34) break;
 					penv->nGlobalVol = 64;
 					penv->nPPC = 5*12;
 					if (34 + 14u*lpStream[dwPos+1] > dwMemLength - dwPos) break;
@@ -321,6 +326,7 @@ BOOL CSoundFile_ReadMDL(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 					}
 				}
 				dwPos += 34 + 14*lpStream[dwPos+1];
+				if (dwPos > dwMemLength - 2) break;
 			}
 			for (j=1; j<=_this->m_nInstruments; j++) if (!_this->Headers[j])
 			{
@@ -412,13 +418,16 @@ BOOL CSoundFile_ReadMDL(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 			for (UINT chn=0; chn<_this->m_nChannels; chn++) if ((patterntracks[ipat*32+chn]) && (patterntracks[ipat*32+chn] <= ntracks))
 			{
 			    const BYTE *lpTracks = lpStream + dwTrackPos;
-			    UINT len = lpTracks[0] | (lpTracks[1] << 8);
+			    UINT len = 0;
+			    if (dwTrackPos + 2 < dwMemLength)
+				len = lpTracks[0] | (lpTracks[1] << 8);
+
 			    if (len < dwMemLength-dwTrackPos) {
 				MODCOMMAND *m = _this->Patterns[ipat] + chn;
 				UINT nTrack = patterntracks[ipat*32+chn];
 
 				lpTracks += 2;
-				for (UINT ntrk=1; ntrk<nTrack && lpTracks + 1 < (dwMemLength + lpStream - len); ntrk++)
+				for (UINT ntrk=1; ntrk<nTrack && lpTracks < (dwMemLength + lpStream - len - 2); ntrk++)
 				{
 					lpTracks += len;
 					len = lpTracks[0] | (lpTracks[1] << 8);

data/dependencies/SDL_sound/libmodplug/load_med.c

@@ -575,8 +575,8 @@ BOOL CSoundFile_ReadMed(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 				nSections = 0;
 			}
 			UINT pseq = 0;
-			
-			if ((playseqtable) && (playseqtable < dwMemLength) && (nplayseq*4 + 4 < dwMemLength - playseqtable))
+
+			if ((playseqtable) && (playseqtable < dwMemLength - 4) && ((nplayseq+1)*4 < dwMemLength - playseqtable))
 			{
 				pseq = bswapBE32(((LPDWORD)(lpStream+playseqtable))[nplayseq]);
 			}
@@ -624,11 +624,12 @@ BOOL CSoundFile_ReadMed(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 		UINT len = bswapBE32(psdh->length);
 		if ((len > MAX_SAMPLE_LENGTH) || (dwPos + len + 6 > dwMemLength)) len = 0;
 		UINT flags = RS_PCM8S, stype = bswapBE16(psdh->type);
-		dwPos += 6;
+		LPSTR psdata = (LPSTR)(lpStream + dwPos + 6);
+		UINT bLimit = dwMemLength - dwPos - 6;
 		if (stype & 0x80)
 		{
-			dwPos += (stype & 0x20) ? 14 : 6;
-			if (dwPos >= dwMemLength) continue;
+			psdata += (stype & 0x20) ? 14 : 6;
+			bLimit -= (stype & 0x20) ? 14 : 6;
 		} else
 		{
 			if (stype & 0x10)
@@ -643,7 +644,7 @@ BOOL CSoundFile_ReadMed(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 			if (stype & 0x20) len /= 2;
 		}
 		_this->Ins[iSmp+1].nLength = len;
-		CSoundFile_ReadSample(_this, &_this->Ins[iSmp+1], flags, (const char *)(lpStream + dwPos), dwMemLength - dwPos);
+		CSoundFile_ReadSample(_this, &_this->Ins[iSmp+1], flags, psdata, bLimit);
 	}
 	// Reading patterns (blocks)
 	if (wNumBlocks > MAX_PATTERNS) wNumBlocks = MAX_PATTERNS;

data/dependencies/SDL_sound/libmodplug/load_mt2.c

@@ -122,6 +122,19 @@ typedef struct _MT2GROUP
 #pragma pack()
 
 
+static int calcNumOnes(int number) {
+	int cnt = 0;
+
+	while(number)
+	{
+		number &= (number -1);
+		cnt ++;
+	}
+
+	return(cnt);
+}
+
+
 static VOID ConvertMT2Command(CSoundFile *that, MODCOMMAND *m, const MT2COMMAND *p)
 //---------------------------------------------------------------------------
 {
@@ -188,7 +201,7 @@ BOOL CSoundFile_ReadMT2(CSoundFile *_this, LPCBYTE lpStream, DWORD dwMemLength)
 	const MT2INSTRUMENT *InstrMap[255];
 	const MT2SAMPLE *SampleMap[256];
 
-	if ((!lpStream) || (dwMemLength < sizeof(MT2FILEHEADER))
+	if ((!lpStream) || (dwMemLength < sizeof(MT2FILEHEADER) + 4)
 	 || (pfh->dwMT20 != 0x3032544D)
 	 || (pfh->wVersion < 0x0200) || (pfh->wVersion >= 0x0300)
 	 || (pfh->wChannels < 4) || (pfh->wChannels > 64)) return FALSE;
@@ -246,6 +259,7 @@ BOOL CSoundFile_ReadMT2(CSoundFile *_this, LPCBYTE lpStream, DWORD dwMemLength)
 		UINT wDataLen = (pmp->wDataLen + 1) & ~1;
 		dwMemPos += 6;
 		if (dwMemPos > dwMemLength - wDataLen || wDataLen > dwMemLength) break;
+
 		UINT nLines = pmp->wLines;
 		if ((iPat < MAX_PATTERNS) && (nLines > 0) && (nLines <= 256))
 		{
@@ -254,11 +268,13 @@ BOOL CSoundFile_ReadMT2(CSoundFile *_this, LPCBYTE lpStream, DWORD dwMemLength)
 			if (!_this->Patterns[iPat]) return TRUE;
 			MODCOMMAND *m = _this->Patterns[iPat];
 			UINT len = wDataLen;
+			if (len <= 4) return TRUE;
+
 			if (pfh->fulFlags & 1) // Packed Patterns
 			{
 				const BYTE *p = lpStream+dwMemPos;
 				UINT pos = 0, row=0, ch=0;
-				while (pos < len)
+				while (pos < len - 4)
 				{
 					MT2COMMAND cmd;
 					UINT infobyte = p[pos++];
@@ -273,13 +289,14 @@ BOOL CSoundFile_ReadMT2(CSoundFile *_this, LPCBYTE lpStream, DWORD dwMemLength)
 					{
 						UINT patpos = row*_this->m_nChannels+ch;
 						cmd.note = cmd.instr = cmd.vol = cmd.pan = cmd.fxcmd = cmd.fxparam1 = cmd.fxparam2 = 0;
-						if ((infobyte & 1)  && (pos < len)) cmd.note = p[pos++];
-						if ((infobyte & 2)  && (pos < len)) cmd.instr = p[pos++];
-						if ((infobyte & 4)  && (pos < len)) cmd.vol = p[pos++];
-						if ((infobyte & 8)  && (pos < len)) cmd.pan = p[pos++];
-						if ((infobyte & 16) && (pos < len)) cmd.fxcmd = p[pos++];
-						if ((infobyte & 32) && (pos < len)) cmd.fxparam1 = p[pos++];
-						if ((infobyte & 64) && (pos < len)) cmd.fxparam2 = p[pos++];
+						if (pos >= len - calcNumOnes(infobyte & 0x7F)) break;
+						if (infobyte & 1) cmd.note = p[pos++];
+						if (infobyte & 2) cmd.instr = p[pos++];
+						if (infobyte & 4) cmd.vol = p[pos++];
+						if (infobyte & 8) cmd.pan = p[pos++];
+						if (infobyte & 16) cmd.fxcmd = p[pos++];
+						if (infobyte & 32) cmd.fxparam1 = p[pos++];
+						if (infobyte & 64) cmd.fxparam2 = p[pos++];
 						ConvertMT2Command(_this, &m[patpos], &cmd);
 					}
 					row += rptcount+1;
@@ -361,7 +378,7 @@ BOOL CSoundFile_ReadMT2(CSoundFile *_this, LPCBYTE lpStream, DWORD dwMemLength)
 		{
 			if (dwMemPos + sizeof(MT2INSTRUMENT) - 4 > dwMemLength) return TRUE;
 			InstrMap[iIns-1] = pmi;
-			if (penv)
+			if (penv && pmi->dwDataLen >= sizeof(MT2INSTRUMENT) - 40)
 			{
 				penv->nFadeOut = pmi->wFadeOut;
 				penv->nNNA = pmi->wNNA & 3;
@@ -397,6 +414,10 @@ BOOL CSoundFile_ReadMT2(CSoundFile *_this, LPCBYTE lpStream, DWORD dwMemLength)
 							pedata[i] = NULL;
 						}
 					}
+
+					// envelopes exceed file length?
+					if (dwEnvPos > dwMemLength) return TRUE;
+
 				}
 				// Load envelopes
 				for (UINT iEnv=0; iEnv<4; iEnv++) if (pehdr[iEnv])
@@ -467,7 +488,7 @@ BOOL CSoundFile_ReadMT2(CSoundFile *_this, LPCBYTE lpStream, DWORD dwMemLength)
 	_this->m_nSamples = (pfh->wSamples < MAX_SAMPLES) ? pfh->wSamples : MAX_SAMPLES-1;
 	for (UINT iSmp=1; iSmp<=256; iSmp++)
 	{
-		if (dwMemPos+36 > dwMemLength) return TRUE;
+		if (dwMemPos > dwMemLength - 36) return TRUE;
 		const MT2SAMPLE *pms = (MT2SAMPLE *)(lpStream+dwMemPos);
 		if (pms->dwDataLen > dwMemLength - (dwMemPos+36)) return TRUE;
 		if (pms->dwDataLen > 0)
@@ -505,8 +526,7 @@ BOOL CSoundFile_ReadMT2(CSoundFile *_this, LPCBYTE lpStream, DWORD dwMemLength)
 		if (iMap<_this->m_nInstruments) penv = _this->Headers[iMap+1];
 		for (UINT iGrp=0; iGrp<pmi->wSamples; iGrp++)
 		{
-			if (dwMemPos+8 > dwMemLength) return TRUE;
-			if (penv)
+			if (penv && dwMemPos < dwMemLength && dwMemPos < dwMemLength - 8)
 			{
 				const MT2GROUP *pmg = (MT2GROUP *)(lpStream+dwMemPos);
 				for (UINT i=0; i<96; i++)
@@ -537,7 +557,7 @@ BOOL CSoundFile_ReadMT2(CSoundFile *_this, LPCBYTE lpStream, DWORD dwMemLength)
 			if (psmp->nLength > 0 && dwMemPos < dwMemLength)
 			{
 				UINT rsflags;
-				
+
 				if (pms->nChannels == 2)
 					rsflags = (psmp->uFlags & CHN_16BIT) ? RS_STPCM16D : RS_STPCM8D;
 				else
@@ -546,13 +566,12 @@ BOOL CSoundFile_ReadMT2(CSoundFile *_this, LPCBYTE lpStream, DWORD dwMemLength)
 				dwMemPos += CSoundFile_ReadSample(_this, psmp, rsflags, (LPCSTR)(lpStream+dwMemPos), dwMemLength-dwMemPos);
 			}
 		} else
-		if (dwMemPos+4 < dwMemLength)
+		if (dwMemPos < dwMemLength-4)
 		{
 			UINT nNameLen = *(DWORD *)(lpStream+dwMemPos);
 			dwMemPos += nNameLen + 16;
 		}
-		if (dwMemPos+4 >= dwMemLength) break;
+		if (dwMemPos >= dwMemLength-4) break;
 	}
 	return TRUE;
 }
-

data/dependencies/SDL_sound/libmodplug/load_okt.c

@@ -10,18 +10,20 @@
 //////////////////////////////////////////////
 #include "libmodplug.h"
 
+#define MAGIC(a,b,c,d) (((a) << 24UL) | ((b) << 16UL) | ((c) << 8UL) | (d))
+
+#pragma pack(1)
 typedef struct OKTFILEHEADER
 {
 	DWORD okta;		// "OKTA"
 	DWORD song;		// "SONG"
 	DWORD cmod;		// "CMOD"
-	DWORD fixed8;
+	DWORD cmodlen;
 	BYTE chnsetup[8];
 	DWORD samp;		// "SAMP"
 	DWORD samplen;
 } OKTFILEHEADER;
 
-
 typedef struct OKTSAMPLE
 {
 	CHAR name[20];
@@ -33,20 +35,29 @@ typedef struct OKTSAMPLE
 	BYTE pad2;
 	BYTE pad3;
 } OKTSAMPLE;
+#pragma pack()
+
 
+static DWORD readBE32(const BYTE *v)
+{
+	return (v[0] << 24UL) | (v[1] << 16UL) | (v[2] << 8UL) | v[3];
+}
 
 BOOL CSoundFile_ReadOKT(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLength)
 //---------------------------------------------------------------
 {
 	const OKTFILEHEADER *pfh = (OKTFILEHEADER *)lpStream;
-	DWORD dwMemPos = sizeof(OKTFILEHEADER);
+	DWORD dwMemPos = sizeof(OKTFILEHEADER), dwSize;
 	UINT nsamples = 0, norders = 0;//, npatterns = 0
 
 	if ((!lpStream) || (dwMemLength < 1024)) return FALSE;
-	if ((pfh->okta != 0x41544B4F) || (pfh->song != 0x474E4F53)
-	 || (pfh->cmod != 0x444F4D43) || (pfh->chnsetup[0]) || (pfh->chnsetup[2])
-	 || (pfh->chnsetup[4]) || (pfh->chnsetup[6]) || (pfh->fixed8 != 0x08000000)
-	 || (pfh->samp != 0x504D4153)) return FALSE;
+	if ((bswapBE32(pfh->okta) != MAGIC('O','K','T','A'))
+	 || (bswapBE32(pfh->song) != MAGIC('S','O','N','G'))
+	 || (bswapBE32(pfh->cmod) != MAGIC('C','M','O','D'))
+	 || (bswapBE32(pfh->cmodlen) != 8)
+	 || (pfh->chnsetup[0]) || (pfh->chnsetup[2])
+	 || (pfh->chnsetup[4]) || (pfh->chnsetup[6])
+	 || (bswapBE32(pfh->samp) != MAGIC('S','A','M','P'))) return FALSE;
 	_this->m_nType = MOD_TYPE_OKT;
 	_this->m_nChannels = 4 + pfh->chnsetup[1] + pfh->chnsetup[3] + pfh->chnsetup[5] + pfh->chnsetup[7];
 	if (_this->m_nChannels > MAX_CHANNELS) _this->m_nChannels = MAX_CHANNELS;
@@ -56,10 +67,10 @@ BOOL CSoundFile_ReadOKT(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 	// Reading samples
 	for (UINT smp=1; smp <= nsamples; smp++)
 	{
-		if (dwMemPos + sizeof(OKTSAMPLE) >= dwMemLength) return TRUE;
+		if (dwMemPos >= dwMemLength - sizeof(OKTSAMPLE)) return TRUE;
 		if (smp < MAX_SAMPLES)
 		{
-			OKTSAMPLE *psmp = (OKTSAMPLE *)(lpStream + dwMemPos);
+			const OKTSAMPLE *psmp = (const OKTSAMPLE *)(lpStream + dwMemPos);
 			MODINSTRUMENT *pins = &_this->Ins[smp];
 
 			pins->uFlags = 0;
@@ -74,42 +85,52 @@ BOOL CSoundFile_ReadOKT(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 		dwMemPos += sizeof(OKTSAMPLE);
 	}
 	// SPEE
-	if (dwMemPos + 10 > dwMemLength) return TRUE;
-	if (*((DWORD *)(lpStream + dwMemPos)) == 0x45455053)
+	if (dwMemPos >= dwMemLength - 12) return TRUE;
+	if (readBE32(lpStream + dwMemPos) == MAGIC('S','P','E','E'))
 	{
 		_this->m_nDefaultSpeed = lpStream[dwMemPos+9];
-		dwMemPos += bswapBE32(*((DWORD *)(lpStream + dwMemPos + 4))) + 8;
+
+		dwSize = readBE32(lpStream + dwMemPos + 4);
+		if (dwSize > dwMemLength - 8 || dwMemPos > dwMemLength - dwSize - 8) return TRUE;
+		dwMemPos += dwSize + 8;
 	}
 	// SLEN
 	if (dwMemPos + 10 > dwMemLength) return TRUE;
-	if (*((DWORD *)(lpStream + dwMemPos)) == 0x4E454C53)
+	if (readBE32(lpStream + dwMemPos) == MAGIC('S','L','E','N'))
 	{
-		if (dwMemPos + 10 > dwMemLength) return TRUE;
 	//	npatterns = lpStream[dwMemPos+9];
-		dwMemPos += bswapBE32(*((DWORD *)(lpStream + dwMemPos + 4))) + 8;
+
+		dwSize = readBE32(lpStream + dwMemPos + 4);
+		if (dwSize > dwMemLength - 8 || dwMemPos > dwMemLength - dwSize - 8) return TRUE;
+		dwMemPos += dwSize + 8;
 	}
 	// PLEN
 	if (dwMemPos + 10 > dwMemLength) return TRUE;
-	if (*((DWORD *)(lpStream + dwMemPos)) == 0x4E454C50)
+	if (readBE32(lpStream + dwMemPos) == MAGIC('P','L','E','N'))
 	{
-		if (dwMemPos + 10 > dwMemLength) return TRUE;
 		norders = lpStream[dwMemPos+9];
-		dwMemPos += bswapBE32(*((DWORD *)(lpStream + dwMemPos + 4))) + 8;
+
+		dwSize = readBE32(lpStream + dwMemPos + 4);
+		if (dwSize > dwMemLength - 8 || dwMemPos > dwMemLength - dwSize - 8) return TRUE;
+		dwMemPos += dwSize + 8;
 	}
 	// PATT
 	if (dwMemPos + 8 > dwMemLength) return TRUE;
-	if (*((DWORD *)(lpStream + dwMemPos)) == 0x54544150)
+	if (readBE32(lpStream + dwMemPos) == MAGIC('P','A','T','T'))
 	{
 		UINT orderlen = norders;
 		if (orderlen >= MAX_ORDERS) orderlen = MAX_ORDERS-1;
 		if (dwMemPos + 8 + orderlen > dwMemLength) return TRUE;
 		for (UINT i=0; i<orderlen; i++) _this->Order[i] = lpStream[dwMemPos+8+i];
 		for (UINT j=orderlen; j>1; j--) { if (_this->Order[j-1]) break; _this->Order[j-1] = 0xFF; }
-		dwMemPos += bswapBE32(*((DWORD *)(lpStream + dwMemPos + 4))) + 8;
+
+		dwSize = readBE32(lpStream + dwMemPos + 4);
+		if (dwSize > dwMemLength - 8 || dwMemPos > dwMemLength - dwSize - 8) return TRUE;
+		dwMemPos += dwSize + 8;
 	}
 	// PBOD
 	UINT npat = 0;
-	while ((dwMemPos+10 < dwMemLength) && (*((DWORD *)(lpStream + dwMemPos)) == 0x444F4250))
+	while ((dwMemPos < dwMemLength - 10) && (readBE32(lpStream + dwMemPos) == MAGIC('P','B','O','D')))
 	{
 		DWORD dwPos = dwMemPos + 10;
 		UINT rows = lpStream[dwMemPos+9];
@@ -181,15 +202,21 @@ BOOL CSoundFile_ReadOKT(CSoundFile *_this, const BYTE *lpStream, DWORD dwMemLeng
 			}
 		}
 		npat++;
-		dwMemPos += bswapBE32(*((DWORD *)(lpStream + dwMemPos + 4))) + 8;
+
+		dwSize = readBE32(lpStream + dwMemPos + 4);
+		if (dwSize > dwMemLength - 8 || dwMemPos > dwMemLength - dwSize - 8) return TRUE;
+		dwMemPos += dwSize + 8;
 	}
 	// SBOD
 	UINT nsmp = 1;
-	while ((dwMemPos+10 < dwMemLength) && (*((DWORD *)(lpStream + dwMemPos)) == 0x444F4253))
+	while ((dwMemPos < dwMemLength-10) && (readBE32(lpStream + dwMemPos) == MAGIC('S','B','O','D')))
 	{
 		if (nsmp < MAX_SAMPLES) CSoundFile_ReadSample(_this, &_this->Ins[nsmp], RS_PCM8S, (LPSTR)(lpStream+dwMemPos+8), dwMemLength-dwMemPos-8);
-		dwMemPos += bswapBE32(*((DWORD *)(lpStream + dwMemPos + 4))) + 8;
 		nsmp++;
+
+		dwSize = readBE32(lpStream + dwMemPos + 4);
+		if (dwSize > dwMemLength - 8 || dwMemPos > dwMemLength - dwSize - 8) return TRUE;
+		dwMemPos += dwSize + 8;
 	}
 	return TRUE;
 }

data/dependencies/SDL_sound/libmodplug/load_psm.c

@@ -100,7 +100,7 @@ BOOL CSoundFile_ReadPSM(CSoundFile *_this, LPCBYTE lpStream, DWORD dwMemLength)
 //	DWORD smpnames[MAX_SAMPLES];
 	DWORD patptrs[MAX_PATTERNS];
 	BYTE samplemap[MAX_SAMPLES];
-	UINT nPatterns;
+	UINT nPatterns = 0;
 
 	if (dwMemLength < 256) return FALSE;
 
@@ -309,8 +309,10 @@ BOOL CSoundFile_ReadPSM(CSoundFile *_this, LPCBYTE lpStream, DWORD dwMemLength)
 			if ((flags & 0x40) && (pos+1 < len))
 			{
 				UINT nins = p[pos++];
-				if (nins < MAX_SAMPLES)
+				if (nins >= _this->m_nSamples) {
+				} else {
 					sp->instr = samplemap[nins];
+				}
 			}
 			// Volume
 			if ((flags & 0x20) && (pos < len))