src/audio/SDL_wave.c
author Petr Písař <ppisar@redhat.com>
Mon, 10 Jun 2019 08:54:11 -0700
branchSDL-1.2
changeset 12816 416136310b88
parent 12815 a6e3d2f5183e
child 12817 faf9abbcfb5f
permissions -rw-r--r--
CVE-2019-7577: Fix a buffer overread in MS_ADPCM_decode
If RIFF/WAV data chunk length is shorter then expected for an audio
format defined in preceeding RIFF/WAV format headers, a buffer
overread can happen.

This patch fixes it by checking a MS ADPCM data to be decoded are not
past the initialized buffer.

CVE-2019-7577
Reproducer: https://bugzilla.libsdl.org/show_bug.cgi?id=4492

Signed-off-by: Petr Písař <ppisar@redhat.com>
slouken@0
     1
/*
slouken@0
     2
    SDL - Simple DirectMedia Layer
slouken@6137
     3
    Copyright (C) 1997-2012 Sam Lantinga
slouken@0
     4
slouken@0
     5
    This library is free software; you can redistribute it and/or
slouken@1312
     6
    modify it under the terms of the GNU Lesser General Public
slouken@0
     7
    License as published by the Free Software Foundation; either
slouken@1312
     8
    version 2.1 of the License, or (at your option) any later version.
slouken@0
     9
slouken@0
    10
    This library is distributed in the hope that it will be useful,
slouken@0
    11
    but WITHOUT ANY WARRANTY; without even the implied warranty of
slouken@0
    12
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
slouken@1312
    13
    Lesser General Public License for more details.
slouken@0
    14
slouken@1312
    15
    You should have received a copy of the GNU Lesser General Public
slouken@1312
    16
    License along with this library; if not, write to the Free Software
slouken@1312
    17
    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
slouken@0
    18
slouken@0
    19
    Sam Lantinga
slouken@252
    20
    slouken@libsdl.org
slouken@0
    21
*/
slouken@1402
    22
#include "SDL_config.h"
slouken@0
    23
slouken@0
    24
/* Microsoft WAVE file loading routines */
slouken@0
    25
slouken@0
    26
#include "SDL_audio.h"
slouken@0
    27
#include "SDL_wave.h"
slouken@0
    28
slouken@0
    29
slouken@0
    30
static int ReadChunk(SDL_RWops *src, Chunk *chunk);
slouken@0
    31
slouken@0
    32
struct MS_ADPCM_decodestate {
slouken@0
    33
	Uint8 hPredictor;
slouken@0
    34
	Uint16 iDelta;
slouken@0
    35
	Sint16 iSamp1;
slouken@0
    36
	Sint16 iSamp2;
slouken@0
    37
};
slouken@0
    38
static struct MS_ADPCM_decoder {
slouken@0
    39
	WaveFMT wavefmt;
slouken@0
    40
	Uint16 wSamplesPerBlock;
slouken@0
    41
	Uint16 wNumCoef;
slouken@0
    42
	Sint16 aCoeff[7][2];
slouken@0
    43
	/* * * */
slouken@0
    44
	struct MS_ADPCM_decodestate state[2];
slouken@0
    45
} MS_ADPCM_state;
slouken@0
    46
slouken@0
    47
static int InitMS_ADPCM(WaveFMT *format)
slouken@0
    48
{
slouken@0
    49
	Uint8 *rogue_feel;
slouken@0
    50
	int i;
slouken@0
    51
slouken@0
    52
	/* Set the rogue pointer to the MS_ADPCM specific data */
slouken@0
    53
	MS_ADPCM_state.wavefmt.encoding = SDL_SwapLE16(format->encoding);
slouken@0
    54
	MS_ADPCM_state.wavefmt.channels = SDL_SwapLE16(format->channels);
slouken@0
    55
	MS_ADPCM_state.wavefmt.frequency = SDL_SwapLE32(format->frequency);
slouken@0
    56
	MS_ADPCM_state.wavefmt.byterate = SDL_SwapLE32(format->byterate);
slouken@0
    57
	MS_ADPCM_state.wavefmt.blockalign = SDL_SwapLE16(format->blockalign);
slouken@0
    58
	MS_ADPCM_state.wavefmt.bitspersample =
slouken@0
    59
					 SDL_SwapLE16(format->bitspersample);
slouken@0
    60
	rogue_feel = (Uint8 *)format+sizeof(*format);
slouken@0
    61
	if ( sizeof(*format) == 16 ) {
slouken@0
    62
		rogue_feel += sizeof(Uint16);
slouken@0
    63
	}
slouken@0
    64
	MS_ADPCM_state.wSamplesPerBlock = ((rogue_feel[1]<<8)|rogue_feel[0]);
slouken@0
    65
	rogue_feel += sizeof(Uint16);
slouken@0
    66
	MS_ADPCM_state.wNumCoef = ((rogue_feel[1]<<8)|rogue_feel[0]);
slouken@0
    67
	rogue_feel += sizeof(Uint16);
slouken@0
    68
	if ( MS_ADPCM_state.wNumCoef != 7 ) {
slouken@0
    69
		SDL_SetError("Unknown set of MS_ADPCM coefficients");
slouken@0
    70
		return(-1);
slouken@0
    71
	}
slouken@0
    72
	for ( i=0; i<MS_ADPCM_state.wNumCoef; ++i ) {
slouken@0
    73
		MS_ADPCM_state.aCoeff[i][0] = ((rogue_feel[1]<<8)|rogue_feel[0]);
slouken@0
    74
		rogue_feel += sizeof(Uint16);
slouken@0
    75
		MS_ADPCM_state.aCoeff[i][1] = ((rogue_feel[1]<<8)|rogue_feel[0]);
slouken@0
    76
		rogue_feel += sizeof(Uint16);
slouken@0
    77
	}
slouken@0
    78
	return(0);
slouken@0
    79
}
slouken@0
    80
slouken@0
    81
static Sint32 MS_ADPCM_nibble(struct MS_ADPCM_decodestate *state,
slouken@0
    82
					Uint8 nybble, Sint16 *coeff)
slouken@0
    83
{
slouken@0
    84
	const Sint32 max_audioval = ((1<<(16-1))-1);
slouken@0
    85
	const Sint32 min_audioval = -(1<<(16-1));
slouken@0
    86
	const Sint32 adaptive[] = {
slouken@0
    87
		230, 230, 230, 230, 307, 409, 512, 614,
slouken@0
    88
		768, 614, 512, 409, 307, 230, 230, 230
slouken@0
    89
	};
slouken@0
    90
	Sint32 new_sample, delta;
slouken@0
    91
slouken@0
    92
	new_sample = ((state->iSamp1 * coeff[0]) +
slouken@0
    93
		      (state->iSamp2 * coeff[1]))/256;
slouken@0
    94
	if ( nybble & 0x08 ) {
slouken@0
    95
		new_sample += state->iDelta * (nybble-0x10);
slouken@0
    96
	} else {
slouken@0
    97
		new_sample += state->iDelta * nybble;
slouken@0
    98
	}
slouken@0
    99
	if ( new_sample < min_audioval ) {
slouken@0
   100
		new_sample = min_audioval;
slouken@0
   101
	} else
slouken@0
   102
	if ( new_sample > max_audioval ) {
slouken@0
   103
		new_sample = max_audioval;
slouken@0
   104
	}
slouken@0
   105
	delta = ((Sint32)state->iDelta * adaptive[nybble])/256;
slouken@0
   106
	if ( delta < 16 ) {
slouken@0
   107
		delta = 16;
slouken@0
   108
	}
slouken@1428
   109
	state->iDelta = (Uint16)delta;
slouken@0
   110
	state->iSamp2 = state->iSamp1;
slouken@1428
   111
	state->iSamp1 = (Sint16)new_sample;
slouken@0
   112
	return(new_sample);
slouken@0
   113
}
slouken@0
   114
slouken@0
   115
static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
slouken@0
   116
{
slouken@0
   117
	struct MS_ADPCM_decodestate *state[2];
ppisar@12816
   118
	Uint8 *freeable, *encoded, *encoded_end, *decoded;
slouken@0
   119
	Sint32 encoded_len, samplesleft;
slouken@0
   120
	Sint8 nybble, stereo;
slouken@0
   121
	Sint16 *coeff[2];
slouken@0
   122
	Sint32 new_sample;
slouken@0
   123
slouken@0
   124
	/* Allocate the proper sized output buffer */
slouken@0
   125
	encoded_len = *audio_len;
slouken@0
   126
	encoded = *audio_buf;
ppisar@12816
   127
	encoded_end = encoded + encoded_len;
slouken@0
   128
	freeable = *audio_buf;
slouken@0
   129
	*audio_len = (encoded_len/MS_ADPCM_state.wavefmt.blockalign) * 
slouken@0
   130
				MS_ADPCM_state.wSamplesPerBlock*
slouken@0
   131
				MS_ADPCM_state.wavefmt.channels*sizeof(Sint16);
slouken@1336
   132
	*audio_buf = (Uint8 *)SDL_malloc(*audio_len);
slouken@0
   133
	if ( *audio_buf == NULL ) {
slouken@0
   134
		SDL_Error(SDL_ENOMEM);
slouken@0
   135
		return(-1);
slouken@0
   136
	}
slouken@0
   137
	decoded = *audio_buf;
slouken@0
   138
slouken@0
   139
	/* Get ready... Go! */
slouken@0
   140
	stereo = (MS_ADPCM_state.wavefmt.channels == 2);
slouken@0
   141
	state[0] = &MS_ADPCM_state.state[0];
slouken@0
   142
	state[1] = &MS_ADPCM_state.state[stereo];
slouken@0
   143
	while ( encoded_len >= MS_ADPCM_state.wavefmt.blockalign ) {
slouken@0
   144
		/* Grab the initial information for this block */
ppisar@12816
   145
		if (encoded + 7 + (stereo ? 7 : 0) > encoded_end) goto too_short;
slouken@0
   146
		state[0]->hPredictor = *encoded++;
slouken@0
   147
		if ( stereo ) {
slouken@0
   148
			state[1]->hPredictor = *encoded++;
slouken@0
   149
		}
slouken@0
   150
		state[0]->iDelta = ((encoded[1]<<8)|encoded[0]);
slouken@0
   151
		encoded += sizeof(Sint16);
slouken@0
   152
		if ( stereo ) {
slouken@0
   153
			state[1]->iDelta = ((encoded[1]<<8)|encoded[0]);
slouken@0
   154
			encoded += sizeof(Sint16);
slouken@0
   155
		}
slouken@0
   156
		state[0]->iSamp1 = ((encoded[1]<<8)|encoded[0]);
slouken@0
   157
		encoded += sizeof(Sint16);
slouken@0
   158
		if ( stereo ) {
slouken@0
   159
			state[1]->iSamp1 = ((encoded[1]<<8)|encoded[0]);
slouken@0
   160
			encoded += sizeof(Sint16);
slouken@0
   161
		}
slouken@0
   162
		state[0]->iSamp2 = ((encoded[1]<<8)|encoded[0]);
slouken@0
   163
		encoded += sizeof(Sint16);
slouken@0
   164
		if ( stereo ) {
slouken@0
   165
			state[1]->iSamp2 = ((encoded[1]<<8)|encoded[0]);
slouken@0
   166
			encoded += sizeof(Sint16);
slouken@0
   167
		}
slouken@0
   168
		coeff[0] = MS_ADPCM_state.aCoeff[state[0]->hPredictor];
slouken@0
   169
		coeff[1] = MS_ADPCM_state.aCoeff[state[1]->hPredictor];
slouken@0
   170
slouken@0
   171
		/* Store the two initial samples we start with */
slouken@0
   172
		decoded[0] = state[0]->iSamp2&0xFF;
slouken@0
   173
		decoded[1] = state[0]->iSamp2>>8;
slouken@0
   174
		decoded += 2;
slouken@0
   175
		if ( stereo ) {
slouken@0
   176
			decoded[0] = state[1]->iSamp2&0xFF;
slouken@0
   177
			decoded[1] = state[1]->iSamp2>>8;
slouken@0
   178
			decoded += 2;
slouken@0
   179
		}
slouken@0
   180
		decoded[0] = state[0]->iSamp1&0xFF;
slouken@0
   181
		decoded[1] = state[0]->iSamp1>>8;
slouken@0
   182
		decoded += 2;
slouken@0
   183
		if ( stereo ) {
slouken@0
   184
			decoded[0] = state[1]->iSamp1&0xFF;
slouken@0
   185
			decoded[1] = state[1]->iSamp1>>8;
slouken@0
   186
			decoded += 2;
slouken@0
   187
		}
slouken@0
   188
slouken@0
   189
		/* Decode and store the other samples in this block */
slouken@0
   190
		samplesleft = (MS_ADPCM_state.wSamplesPerBlock-2)*
slouken@0
   191
					MS_ADPCM_state.wavefmt.channels;
slouken@0
   192
		while ( samplesleft > 0 ) {
ppisar@12816
   193
			if (encoded + 1 > encoded_end) goto too_short;
ppisar@12816
   194
slouken@0
   195
			nybble = (*encoded)>>4;
slouken@0
   196
			new_sample = MS_ADPCM_nibble(state[0],nybble,coeff[0]);
slouken@0
   197
			decoded[0] = new_sample&0xFF;
slouken@0
   198
			new_sample >>= 8;
slouken@0
   199
			decoded[1] = new_sample&0xFF;
slouken@0
   200
			decoded += 2;
slouken@0
   201
slouken@0
   202
			nybble = (*encoded)&0x0F;
slouken@0
   203
			new_sample = MS_ADPCM_nibble(state[1],nybble,coeff[1]);
slouken@0
   204
			decoded[0] = new_sample&0xFF;
slouken@0
   205
			new_sample >>= 8;
slouken@0
   206
			decoded[1] = new_sample&0xFF;
slouken@0
   207
			decoded += 2;
slouken@0
   208
slouken@0
   209
			++encoded;
slouken@0
   210
			samplesleft -= 2;
slouken@0
   211
		}
slouken@0
   212
		encoded_len -= MS_ADPCM_state.wavefmt.blockalign;
slouken@0
   213
	}
slouken@1336
   214
	SDL_free(freeable);
slouken@0
   215
	return(0);
ppisar@12816
   216
too_short:
ppisar@12816
   217
	SDL_SetError("Too short chunk for a MS ADPCM decoder");
ppisar@12816
   218
	SDL_free(freeable);
ppisar@12816
   219
	return(-1);
slouken@0
   220
}
slouken@0
   221
slouken@0
   222
struct IMA_ADPCM_decodestate {
slouken@0
   223
	Sint32 sample;
slouken@0
   224
	Sint8 index;
slouken@0
   225
};
slouken@0
   226
static struct IMA_ADPCM_decoder {
slouken@0
   227
	WaveFMT wavefmt;
slouken@0
   228
	Uint16 wSamplesPerBlock;
slouken@0
   229
	/* * * */
slouken@0
   230
	struct IMA_ADPCM_decodestate state[2];
slouken@0
   231
} IMA_ADPCM_state;
slouken@0
   232
ppisar@12801
   233
static int InitIMA_ADPCM(WaveFMT *format, int length)
slouken@0
   234
{
ppisar@12801
   235
	Uint8 *rogue_feel, *rogue_feel_end;
slouken@0
   236
slouken@0
   237
	/* Set the rogue pointer to the IMA_ADPCM specific data */
ppisar@12801
   238
	if (length < sizeof(*format)) goto too_short;
slouken@0
   239
	IMA_ADPCM_state.wavefmt.encoding = SDL_SwapLE16(format->encoding);
slouken@0
   240
	IMA_ADPCM_state.wavefmt.channels = SDL_SwapLE16(format->channels);
slouken@0
   241
	IMA_ADPCM_state.wavefmt.frequency = SDL_SwapLE32(format->frequency);
slouken@0
   242
	IMA_ADPCM_state.wavefmt.byterate = SDL_SwapLE32(format->byterate);
slouken@0
   243
	IMA_ADPCM_state.wavefmt.blockalign = SDL_SwapLE16(format->blockalign);
slouken@0
   244
	IMA_ADPCM_state.wavefmt.bitspersample =
slouken@0
   245
					 SDL_SwapLE16(format->bitspersample);
slouken@0
   246
	rogue_feel = (Uint8 *)format+sizeof(*format);
ppisar@12801
   247
	rogue_feel_end = (Uint8 *)format + length;
slouken@0
   248
	if ( sizeof(*format) == 16 ) {
slouken@0
   249
		rogue_feel += sizeof(Uint16);
slouken@0
   250
	}
ppisar@12801
   251
	if (rogue_feel + 2 > rogue_feel_end) goto too_short;
slouken@0
   252
	IMA_ADPCM_state.wSamplesPerBlock = ((rogue_feel[1]<<8)|rogue_feel[0]);
slouken@0
   253
	return(0);
ppisar@12801
   254
too_short:
ppisar@12801
   255
	SDL_SetError("Unexpected length of a chunk with an IMA ADPCM format");
ppisar@12801
   256
	return(-1);
slouken@0
   257
}
slouken@0
   258
slouken@0
   259
static Sint32 IMA_ADPCM_nibble(struct IMA_ADPCM_decodestate *state,Uint8 nybble)
slouken@0
   260
{
slouken@0
   261
	const Sint32 max_audioval = ((1<<(16-1))-1);
slouken@0
   262
	const Sint32 min_audioval = -(1<<(16-1));
slouken@0
   263
	const int index_table[16] = {
slouken@0
   264
		-1, -1, -1, -1,
slouken@0
   265
		 2,  4,  6,  8,
slouken@0
   266
		-1, -1, -1, -1,
slouken@0
   267
		 2,  4,  6,  8
slouken@0
   268
	};
slouken@0
   269
	const Sint32 step_table[89] = {
slouken@0
   270
		7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 19, 21, 23, 25, 28, 31,
slouken@0
   271
		34, 37, 41, 45, 50, 55, 60, 66, 73, 80, 88, 97, 107, 118, 130,
slouken@0
   272
		143, 157, 173, 190, 209, 230, 253, 279, 307, 337, 371, 408,
slouken@0
   273
		449, 494, 544, 598, 658, 724, 796, 876, 963, 1060, 1166, 1282,
slouken@0
   274
		1411, 1552, 1707, 1878, 2066, 2272, 2499, 2749, 3024, 3327,
slouken@0
   275
		3660, 4026, 4428, 4871, 5358, 5894, 6484, 7132, 7845, 8630,
slouken@0
   276
		9493, 10442, 11487, 12635, 13899, 15289, 16818, 18500, 20350,
slouken@0
   277
		22385, 24623, 27086, 29794, 32767
slouken@0
   278
	};
slouken@0
   279
	Sint32 delta, step;
slouken@0
   280
ppisar@12800
   281
	/* Clamp index value. The inital value can be invalid. */
ppisar@12800
   282
	if ( state->index > 88 ) {
ppisar@12800
   283
		state->index = 88;
ppisar@12800
   284
	} else
ppisar@12800
   285
	if ( state->index < 0 ) {
ppisar@12800
   286
		state->index = 0;
ppisar@12800
   287
	}
ppisar@12800
   288
slouken@0
   289
	/* Compute difference and new sample value */
slouken@0
   290
	step = step_table[state->index];
slouken@0
   291
	delta = step >> 3;
slouken@0
   292
	if ( nybble & 0x04 ) delta += step;
slouken@0
   293
	if ( nybble & 0x02 ) delta += (step >> 1);
slouken@0
   294
	if ( nybble & 0x01 ) delta += (step >> 2);
slouken@0
   295
	if ( nybble & 0x08 ) delta = -delta;
slouken@0
   296
	state->sample += delta;
slouken@0
   297
slouken@0
   298
	/* Update index value */
slouken@0
   299
	state->index += index_table[nybble];
slouken@0
   300
slouken@0
   301
	/* Clamp output sample */
slouken@0
   302
	if ( state->sample > max_audioval ) {
slouken@0
   303
		state->sample = max_audioval;
slouken@0
   304
	} else
slouken@0
   305
	if ( state->sample < min_audioval ) {
slouken@0
   306
		state->sample = min_audioval;
slouken@0
   307
	}
slouken@0
   308
	return(state->sample);
slouken@0
   309
}
slouken@0
   310
slouken@0
   311
/* Fill the decode buffer with a channel block of data (8 samples) */
slouken@0
   312
static void Fill_IMA_ADPCM_block(Uint8 *decoded, Uint8 *encoded,
slouken@0
   313
	int channel, int numchannels, struct IMA_ADPCM_decodestate *state)
slouken@0
   314
{
slouken@0
   315
	int i;
slouken@0
   316
	Sint8 nybble;
slouken@0
   317
	Sint32 new_sample;
slouken@0
   318
slouken@0
   319
	decoded += (channel * 2);
slouken@0
   320
	for ( i=0; i<4; ++i ) {
slouken@0
   321
		nybble = (*encoded)&0x0F;
slouken@0
   322
		new_sample = IMA_ADPCM_nibble(state, nybble);
slouken@0
   323
		decoded[0] = new_sample&0xFF;
slouken@0
   324
		new_sample >>= 8;
slouken@0
   325
		decoded[1] = new_sample&0xFF;
slouken@0
   326
		decoded += 2 * numchannels;
slouken@0
   327
slouken@0
   328
		nybble = (*encoded)>>4;
slouken@0
   329
		new_sample = IMA_ADPCM_nibble(state, nybble);
slouken@0
   330
		decoded[0] = new_sample&0xFF;
slouken@0
   331
		new_sample >>= 8;
slouken@0
   332
		decoded[1] = new_sample&0xFF;
slouken@0
   333
		decoded += 2 * numchannels;
slouken@0
   334
slouken@0
   335
		++encoded;
slouken@0
   336
	}
slouken@0
   337
}
slouken@0
   338
slouken@0
   339
static int IMA_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
slouken@0
   340
{
slouken@0
   341
	struct IMA_ADPCM_decodestate *state;
ppisar@12815
   342
	Uint8 *freeable, *encoded, *encoded_end, *decoded;
slouken@0
   343
	Sint32 encoded_len, samplesleft;
slouken@1612
   344
	unsigned int c, channels;
slouken@0
   345
slouken@0
   346
	/* Check to make sure we have enough variables in the state array */
slouken@0
   347
	channels = IMA_ADPCM_state.wavefmt.channels;
slouken@1330
   348
	if ( channels > SDL_arraysize(IMA_ADPCM_state.state) ) {
slouken@0
   349
		SDL_SetError("IMA ADPCM decoder can only handle %d channels",
slouken@1330
   350
					SDL_arraysize(IMA_ADPCM_state.state));
slouken@0
   351
		return(-1);
slouken@0
   352
	}
slouken@0
   353
	state = IMA_ADPCM_state.state;
slouken@0
   354
slouken@0
   355
	/* Allocate the proper sized output buffer */
slouken@0
   356
	encoded_len = *audio_len;
slouken@0
   357
	encoded = *audio_buf;
ppisar@12815
   358
	encoded_end = encoded + encoded_len;
slouken@0
   359
	freeable = *audio_buf;
slouken@0
   360
	*audio_len = (encoded_len/IMA_ADPCM_state.wavefmt.blockalign) * 
slouken@0
   361
				IMA_ADPCM_state.wSamplesPerBlock*
slouken@0
   362
				IMA_ADPCM_state.wavefmt.channels*sizeof(Sint16);
slouken@1336
   363
	*audio_buf = (Uint8 *)SDL_malloc(*audio_len);
slouken@0
   364
	if ( *audio_buf == NULL ) {
slouken@0
   365
		SDL_Error(SDL_ENOMEM);
slouken@0
   366
		return(-1);
slouken@0
   367
	}
slouken@0
   368
	decoded = *audio_buf;
slouken@0
   369
slouken@0
   370
	/* Get ready... Go! */
slouken@0
   371
	while ( encoded_len >= IMA_ADPCM_state.wavefmt.blockalign ) {
slouken@0
   372
		/* Grab the initial information for this block */
slouken@0
   373
		for ( c=0; c<channels; ++c ) {
ppisar@12815
   374
			if (encoded + 4 > encoded_end) goto invalid_size;
slouken@0
   375
			/* Fill the state information for this block */
slouken@0
   376
			state[c].sample = ((encoded[1]<<8)|encoded[0]);
slouken@0
   377
			encoded += 2;
slouken@0
   378
			if ( state[c].sample & 0x8000 ) {
slouken@0
   379
				state[c].sample -= 0x10000;
slouken@0
   380
			}
slouken@0
   381
			state[c].index = *encoded++;
slouken@0
   382
			/* Reserved byte in buffer header, should be 0 */
slouken@0
   383
			if ( *encoded++ != 0 ) {
slouken@0
   384
				/* Uh oh, corrupt data?  Buggy code? */;
slouken@0
   385
			}
slouken@0
   386
slouken@0
   387
			/* Store the initial sample we start with */
slouken@1428
   388
			decoded[0] = (Uint8)(state[c].sample&0xFF);
slouken@1428
   389
			decoded[1] = (Uint8)(state[c].sample>>8);
slouken@0
   390
			decoded += 2;
slouken@0
   391
		}
slouken@0
   392
slouken@0
   393
		/* Decode and store the other samples in this block */
slouken@0
   394
		samplesleft = (IMA_ADPCM_state.wSamplesPerBlock-1)*channels;
slouken@0
   395
		while ( samplesleft > 0 ) {
slouken@0
   396
			for ( c=0; c<channels; ++c ) {
ppisar@12815
   397
				if (encoded + 4 > encoded_end) goto invalid_size;
slouken@0
   398
				Fill_IMA_ADPCM_block(decoded, encoded,
slouken@0
   399
						c, channels, &state[c]);
slouken@0
   400
				encoded += 4;
slouken@0
   401
				samplesleft -= 8;
slouken@0
   402
			}
slouken@0
   403
			decoded += (channels * 8 * 2);
slouken@0
   404
		}
slouken@0
   405
		encoded_len -= IMA_ADPCM_state.wavefmt.blockalign;
slouken@0
   406
	}
slouken@1336
   407
	SDL_free(freeable);
slouken@0
   408
	return(0);
ppisar@12815
   409
invalid_size:
ppisar@12815
   410
	SDL_SetError("Unexpected chunk length for an IMA ADPCM decoder");
ppisar@12815
   411
	SDL_free(freeable);
ppisar@12815
   412
	return(-1);
slouken@0
   413
}
slouken@0
   414
slouken@0
   415
SDL_AudioSpec * SDL_LoadWAV_RW (SDL_RWops *src, int freesrc,
slouken@0
   416
		SDL_AudioSpec *spec, Uint8 **audio_buf, Uint32 *audio_len)
slouken@0
   417
{
slouken@0
   418
	int was_error;
slouken@0
   419
	Chunk chunk;
slouken@0
   420
	int lenread;
slouken@0
   421
	int MS_ADPCM_encoded, IMA_ADPCM_encoded;
slouken@0
   422
	int samplesize;
slouken@0
   423
slouken@0
   424
	/* WAV magic header */
slouken@0
   425
	Uint32 RIFFchunk;
slouken@1260
   426
	Uint32 wavelen = 0;
slouken@0
   427
	Uint32 WAVEmagic;
slouken@1260
   428
	Uint32 headerDiff = 0;
slouken@0
   429
slouken@0
   430
	/* FMT chunk */
slouken@0
   431
	WaveFMT *format = NULL;
slouken@0
   432
slouken@0
   433
	/* Make sure we are passed a valid data source */
slouken@0
   434
	was_error = 0;
slouken@0
   435
	if ( src == NULL ) {
slouken@0
   436
		was_error = 1;
slouken@0
   437
		goto done;
slouken@0
   438
	}
slouken@0
   439
		
slouken@0
   440
	/* Check the magic header */
slouken@0
   441
	RIFFchunk	= SDL_ReadLE32(src);
slouken@0
   442
	wavelen		= SDL_ReadLE32(src);
slouken@171
   443
	if ( wavelen == WAVE ) { /* The RIFFchunk has already been read */
slouken@171
   444
		WAVEmagic = wavelen;
slouken@171
   445
		wavelen   = RIFFchunk;
slouken@171
   446
		RIFFchunk = RIFF;
slouken@171
   447
	} else {
slouken@171
   448
		WAVEmagic = SDL_ReadLE32(src);
slouken@171
   449
	}
slouken@0
   450
	if ( (RIFFchunk != RIFF) || (WAVEmagic != WAVE) ) {
slouken@0
   451
		SDL_SetError("Unrecognized file type (not WAVE)");
slouken@0
   452
		was_error = 1;
slouken@0
   453
		goto done;
slouken@0
   454
	}
slouken@1487
   455
	headerDiff += sizeof(Uint32); /* for WAVE */
slouken@0
   456
slouken@0
   457
	/* Read the audio data format chunk */
slouken@0
   458
	chunk.data = NULL;
slouken@0
   459
	do {
slouken@0
   460
		if ( chunk.data != NULL ) {
slouken@1336
   461
			SDL_free(chunk.data);
slouken@4158
   462
			chunk.data = NULL;
slouken@0
   463
		}
slouken@0
   464
		lenread = ReadChunk(src, &chunk);
slouken@0
   465
		if ( lenread < 0 ) {
slouken@0
   466
			was_error = 1;
slouken@0
   467
			goto done;
slouken@0
   468
		}
slouken@1487
   469
		/* 2 Uint32's for chunk header+len, plus the lenread */
slouken@1260
   470
		headerDiff += lenread + 2 * sizeof(Uint32);
slouken@0
   471
	} while ( (chunk.magic == FACT) || (chunk.magic == LIST) );
slouken@0
   472
slouken@0
   473
	/* Decode the audio data format */
slouken@0
   474
	format = (WaveFMT *)chunk.data;
slouken@0
   475
	if ( chunk.magic != FMT ) {
slouken@0
   476
		SDL_SetError("Complex WAVE files not supported");
slouken@0
   477
		was_error = 1;
slouken@0
   478
		goto done;
slouken@0
   479
	}
slouken@0
   480
	MS_ADPCM_encoded = IMA_ADPCM_encoded = 0;
slouken@0
   481
	switch (SDL_SwapLE16(format->encoding)) {
slouken@0
   482
		case PCM_CODE:
slouken@0
   483
			/* We can understand this */
slouken@0
   484
			break;
slouken@0
   485
		case MS_ADPCM_CODE:
slouken@0
   486
			/* Try to understand this */
slouken@0
   487
			if ( InitMS_ADPCM(format) < 0 ) {
slouken@0
   488
				was_error = 1;
slouken@0
   489
				goto done;
slouken@0
   490
			}
slouken@0
   491
			MS_ADPCM_encoded = 1;
slouken@0
   492
			break;
slouken@0
   493
		case IMA_ADPCM_CODE:
slouken@0
   494
			/* Try to understand this */
ppisar@12801
   495
			if ( InitIMA_ADPCM(format, lenread) < 0 ) {
slouken@0
   496
				was_error = 1;
slouken@0
   497
				goto done;
slouken@0
   498
			}
slouken@0
   499
			IMA_ADPCM_encoded = 1;
slouken@0
   500
			break;
slouken@1818
   501
		case MP3_CODE:
slouken@1818
   502
			SDL_SetError("MPEG Layer 3 data not supported",
slouken@1818
   503
					SDL_SwapLE16(format->encoding));
slouken@1818
   504
			was_error = 1;
slouken@1818
   505
			goto done;
slouken@0
   506
		default:
slouken@0
   507
			SDL_SetError("Unknown WAVE data format: 0x%.4x",
slouken@0
   508
					SDL_SwapLE16(format->encoding));
slouken@0
   509
			was_error = 1;
slouken@0
   510
			goto done;
slouken@0
   511
	}
slouken@1336
   512
	SDL_memset(spec, 0, (sizeof *spec));
slouken@0
   513
	spec->freq = SDL_SwapLE32(format->frequency);
slouken@0
   514
	switch (SDL_SwapLE16(format->bitspersample)) {
slouken@0
   515
		case 4:
slouken@0
   516
			if ( MS_ADPCM_encoded || IMA_ADPCM_encoded ) {
slouken@0
   517
				spec->format = AUDIO_S16;
slouken@0
   518
			} else {
slouken@0
   519
				was_error = 1;
slouken@0
   520
			}
slouken@0
   521
			break;
slouken@0
   522
		case 8:
slouken@0
   523
			spec->format = AUDIO_U8;
slouken@0
   524
			break;
slouken@0
   525
		case 16:
slouken@0
   526
			spec->format = AUDIO_S16;
slouken@0
   527
			break;
slouken@0
   528
		default:
slouken@0
   529
			was_error = 1;
slouken@0
   530
			break;
slouken@0
   531
	}
slouken@0
   532
	if ( was_error ) {
slouken@0
   533
		SDL_SetError("Unknown %d-bit PCM data format",
slouken@0
   534
			SDL_SwapLE16(format->bitspersample));
slouken@0
   535
		goto done;
slouken@0
   536
	}
slouken@0
   537
	spec->channels = (Uint8)SDL_SwapLE16(format->channels);
slouken@0
   538
	spec->samples = 4096;		/* Good default buffer size */
slouken@0
   539
slouken@0
   540
	/* Read the audio data chunk */
slouken@0
   541
	*audio_buf = NULL;
slouken@0
   542
	do {
slouken@0
   543
		if ( *audio_buf != NULL ) {
slouken@1336
   544
			SDL_free(*audio_buf);
slouken@4158
   545
			*audio_buf = NULL;
slouken@0
   546
		}
slouken@0
   547
		lenread = ReadChunk(src, &chunk);
slouken@0
   548
		if ( lenread < 0 ) {
slouken@0
   549
			was_error = 1;
slouken@0
   550
			goto done;
slouken@0
   551
		}
slouken@0
   552
		*audio_len = lenread;
slouken@0
   553
		*audio_buf = chunk.data;
slouken@1260
   554
		if(chunk.magic != DATA) headerDiff += lenread + 2 * sizeof(Uint32);
slouken@0
   555
	} while ( chunk.magic != DATA );
slouken@1487
   556
	headerDiff += 2 * sizeof(Uint32); /* for the data chunk and len */
slouken@0
   557
slouken@0
   558
	if ( MS_ADPCM_encoded ) {
slouken@0
   559
		if ( MS_ADPCM_decode(audio_buf, audio_len) < 0 ) {
slouken@0
   560
			was_error = 1;
slouken@0
   561
			goto done;
slouken@0
   562
		}
slouken@0
   563
	}
slouken@0
   564
	if ( IMA_ADPCM_encoded ) {
slouken@0
   565
		if ( IMA_ADPCM_decode(audio_buf, audio_len) < 0 ) {
slouken@0
   566
			was_error = 1;
slouken@0
   567
			goto done;
slouken@0
   568
		}
slouken@0
   569
	}
slouken@0
   570
slouken@0
   571
	/* Don't return a buffer that isn't a multiple of samplesize */
slouken@0
   572
	samplesize = ((spec->format & 0xFF)/8)*spec->channels;
slouken@0
   573
	*audio_len &= ~(samplesize-1);
slouken@0
   574
slouken@0
   575
done:
slouken@0
   576
	if ( format != NULL ) {
slouken@1336
   577
		SDL_free(format);
slouken@0
   578
	}
slouken@1465
   579
	if ( src ) {
slouken@1465
   580
		if ( freesrc ) {
slouken@1465
   581
			SDL_RWclose(src);
slouken@1465
   582
		} else {
slouken@1487
   583
			/* seek to the end of the file (given by the RIFF chunk) */
slouken@1465
   584
			SDL_RWseek(src, wavelen - chunk.length - headerDiff, RW_SEEK_CUR);
slouken@1465
   585
		}
slouken@1260
   586
	}
slouken@0
   587
	if ( was_error ) {
slouken@0
   588
		spec = NULL;
slouken@0
   589
	}
slouken@0
   590
	return(spec);
slouken@0
   591
}
slouken@0
   592
slouken@0
   593
/* Since the WAV memory is allocated in the shared library, it must also
slouken@0
   594
   be freed here.  (Necessary under Win32, VC++)
slouken@0
   595
 */
slouken@0
   596
void SDL_FreeWAV(Uint8 *audio_buf)
slouken@0
   597
{
slouken@0
   598
	if ( audio_buf != NULL ) {
slouken@1336
   599
		SDL_free(audio_buf);
slouken@0
   600
	}
slouken@0
   601
}
slouken@0
   602
slouken@0
   603
static int ReadChunk(SDL_RWops *src, Chunk *chunk)
slouken@0
   604
{
slouken@0
   605
	chunk->magic	= SDL_ReadLE32(src);
slouken@0
   606
	chunk->length	= SDL_ReadLE32(src);
slouken@1336
   607
	chunk->data = (Uint8 *)SDL_malloc(chunk->length);
slouken@0
   608
	if ( chunk->data == NULL ) {
slouken@0
   609
		SDL_Error(SDL_ENOMEM);
slouken@0
   610
		return(-1);
slouken@0
   611
	}
slouken@0
   612
	if ( SDL_RWread(src, chunk->data, chunk->length, 1) != 1 ) {
slouken@0
   613
		SDL_Error(SDL_EFREAD);
slouken@1336
   614
		SDL_free(chunk->data);
slouken@4158
   615
		chunk->data = NULL;
slouken@0
   616
		return(-1);
slouken@0
   617
	}
slouken@0
   618
	return(chunk->length);
slouken@0
   619
}