src/audio/SDL_wave.c
author Petr Písař <ppisar@redhat.com>
Sat, 08 Jun 2019 17:57:43 -0700
branchSDL-1.2
changeset 12800 e52413f52586
parent 6227 e11fd9609d10
child 12801 388987dff7bf
permissions -rw-r--r--
CVE-2019-7572: Fix a buffer overread in IMA_ADPCM_nibble
If an IMA ADPCM block contained an initial index out of step table
range (loaded in IMA_ADPCM_decode()), IMA_ADPCM_nibble() blindly used
this bogus value and that lead to a buffer overread.

This patch fixes it by moving clamping the index value at the
beginning of IMA_ADPCM_nibble() function instead of the end after
an update.

CVE-2019-7572
https://bugzilla.libsdl.org/show_bug.cgi?id=4495

Signed-off-by: Petr Písař <ppisar@redhat.com>
slouken@0
     1
/*
slouken@0
     2
    SDL - Simple DirectMedia Layer
slouken@6137
     3
    Copyright (C) 1997-2012 Sam Lantinga
slouken@0
     4
slouken@0
     5
    This library is free software; you can redistribute it and/or
slouken@1312
     6
    modify it under the terms of the GNU Lesser General Public
slouken@0
     7
    License as published by the Free Software Foundation; either
slouken@1312
     8
    version 2.1 of the License, or (at your option) any later version.
slouken@0
     9
slouken@0
    10
    This library is distributed in the hope that it will be useful,
slouken@0
    11
    but WITHOUT ANY WARRANTY; without even the implied warranty of
slouken@0
    12
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
slouken@1312
    13
    Lesser General Public License for more details.
slouken@0
    14
slouken@1312
    15
    You should have received a copy of the GNU Lesser General Public
slouken@1312
    16
    License along with this library; if not, write to the Free Software
slouken@1312
    17
    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
slouken@0
    18
slouken@0
    19
    Sam Lantinga
slouken@252
    20
    slouken@libsdl.org
slouken@0
    21
*/
slouken@1402
    22
#include "SDL_config.h"
slouken@0
    23
slouken@0
    24
/* Microsoft WAVE file loading routines */
slouken@0
    25
slouken@0
    26
#include "SDL_audio.h"
slouken@0
    27
#include "SDL_wave.h"
slouken@0
    28
slouken@0
    29
slouken@0
    30
static int ReadChunk(SDL_RWops *src, Chunk *chunk);
slouken@0
    31
slouken@0
    32
struct MS_ADPCM_decodestate {
slouken@0
    33
	Uint8 hPredictor;
slouken@0
    34
	Uint16 iDelta;
slouken@0
    35
	Sint16 iSamp1;
slouken@0
    36
	Sint16 iSamp2;
slouken@0
    37
};
slouken@0
    38
static struct MS_ADPCM_decoder {
slouken@0
    39
	WaveFMT wavefmt;
slouken@0
    40
	Uint16 wSamplesPerBlock;
slouken@0
    41
	Uint16 wNumCoef;
slouken@0
    42
	Sint16 aCoeff[7][2];
slouken@0
    43
	/* * * */
slouken@0
    44
	struct MS_ADPCM_decodestate state[2];
slouken@0
    45
} MS_ADPCM_state;
slouken@0
    46
slouken@0
    47
static int InitMS_ADPCM(WaveFMT *format)
slouken@0
    48
{
slouken@0
    49
	Uint8 *rogue_feel;
slouken@0
    50
	int i;
slouken@0
    51
slouken@0
    52
	/* Set the rogue pointer to the MS_ADPCM specific data */
slouken@0
    53
	MS_ADPCM_state.wavefmt.encoding = SDL_SwapLE16(format->encoding);
slouken@0
    54
	MS_ADPCM_state.wavefmt.channels = SDL_SwapLE16(format->channels);
slouken@0
    55
	MS_ADPCM_state.wavefmt.frequency = SDL_SwapLE32(format->frequency);
slouken@0
    56
	MS_ADPCM_state.wavefmt.byterate = SDL_SwapLE32(format->byterate);
slouken@0
    57
	MS_ADPCM_state.wavefmt.blockalign = SDL_SwapLE16(format->blockalign);
slouken@0
    58
	MS_ADPCM_state.wavefmt.bitspersample =
slouken@0
    59
					 SDL_SwapLE16(format->bitspersample);
slouken@0
    60
	rogue_feel = (Uint8 *)format+sizeof(*format);
slouken@0
    61
	if ( sizeof(*format) == 16 ) {
slouken@0
    62
		rogue_feel += sizeof(Uint16);
slouken@0
    63
	}
slouken@0
    64
	MS_ADPCM_state.wSamplesPerBlock = ((rogue_feel[1]<<8)|rogue_feel[0]);
slouken@0
    65
	rogue_feel += sizeof(Uint16);
slouken@0
    66
	MS_ADPCM_state.wNumCoef = ((rogue_feel[1]<<8)|rogue_feel[0]);
slouken@0
    67
	rogue_feel += sizeof(Uint16);
slouken@0
    68
	if ( MS_ADPCM_state.wNumCoef != 7 ) {
slouken@0
    69
		SDL_SetError("Unknown set of MS_ADPCM coefficients");
slouken@0
    70
		return(-1);
slouken@0
    71
	}
slouken@0
    72
	for ( i=0; i<MS_ADPCM_state.wNumCoef; ++i ) {
slouken@0
    73
		MS_ADPCM_state.aCoeff[i][0] = ((rogue_feel[1]<<8)|rogue_feel[0]);
slouken@0
    74
		rogue_feel += sizeof(Uint16);
slouken@0
    75
		MS_ADPCM_state.aCoeff[i][1] = ((rogue_feel[1]<<8)|rogue_feel[0]);
slouken@0
    76
		rogue_feel += sizeof(Uint16);
slouken@0
    77
	}
slouken@0
    78
	return(0);
slouken@0
    79
}
slouken@0
    80
slouken@0
    81
static Sint32 MS_ADPCM_nibble(struct MS_ADPCM_decodestate *state,
slouken@0
    82
					Uint8 nybble, Sint16 *coeff)
slouken@0
    83
{
slouken@0
    84
	const Sint32 max_audioval = ((1<<(16-1))-1);
slouken@0
    85
	const Sint32 min_audioval = -(1<<(16-1));
slouken@0
    86
	const Sint32 adaptive[] = {
slouken@0
    87
		230, 230, 230, 230, 307, 409, 512, 614,
slouken@0
    88
		768, 614, 512, 409, 307, 230, 230, 230
slouken@0
    89
	};
slouken@0
    90
	Sint32 new_sample, delta;
slouken@0
    91
slouken@0
    92
	new_sample = ((state->iSamp1 * coeff[0]) +
slouken@0
    93
		      (state->iSamp2 * coeff[1]))/256;
slouken@0
    94
	if ( nybble & 0x08 ) {
slouken@0
    95
		new_sample += state->iDelta * (nybble-0x10);
slouken@0
    96
	} else {
slouken@0
    97
		new_sample += state->iDelta * nybble;
slouken@0
    98
	}
slouken@0
    99
	if ( new_sample < min_audioval ) {
slouken@0
   100
		new_sample = min_audioval;
slouken@0
   101
	} else
slouken@0
   102
	if ( new_sample > max_audioval ) {
slouken@0
   103
		new_sample = max_audioval;
slouken@0
   104
	}
slouken@0
   105
	delta = ((Sint32)state->iDelta * adaptive[nybble])/256;
slouken@0
   106
	if ( delta < 16 ) {
slouken@0
   107
		delta = 16;
slouken@0
   108
	}
slouken@1428
   109
	state->iDelta = (Uint16)delta;
slouken@0
   110
	state->iSamp2 = state->iSamp1;
slouken@1428
   111
	state->iSamp1 = (Sint16)new_sample;
slouken@0
   112
	return(new_sample);
slouken@0
   113
}
slouken@0
   114
slouken@0
   115
static int MS_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
slouken@0
   116
{
slouken@0
   117
	struct MS_ADPCM_decodestate *state[2];
slouken@0
   118
	Uint8 *freeable, *encoded, *decoded;
slouken@0
   119
	Sint32 encoded_len, samplesleft;
slouken@0
   120
	Sint8 nybble, stereo;
slouken@0
   121
	Sint16 *coeff[2];
slouken@0
   122
	Sint32 new_sample;
slouken@0
   123
slouken@0
   124
	/* Allocate the proper sized output buffer */
slouken@0
   125
	encoded_len = *audio_len;
slouken@0
   126
	encoded = *audio_buf;
slouken@0
   127
	freeable = *audio_buf;
slouken@0
   128
	*audio_len = (encoded_len/MS_ADPCM_state.wavefmt.blockalign) * 
slouken@0
   129
				MS_ADPCM_state.wSamplesPerBlock*
slouken@0
   130
				MS_ADPCM_state.wavefmt.channels*sizeof(Sint16);
slouken@1336
   131
	*audio_buf = (Uint8 *)SDL_malloc(*audio_len);
slouken@0
   132
	if ( *audio_buf == NULL ) {
slouken@0
   133
		SDL_Error(SDL_ENOMEM);
slouken@0
   134
		return(-1);
slouken@0
   135
	}
slouken@0
   136
	decoded = *audio_buf;
slouken@0
   137
slouken@0
   138
	/* Get ready... Go! */
slouken@0
   139
	stereo = (MS_ADPCM_state.wavefmt.channels == 2);
slouken@0
   140
	state[0] = &MS_ADPCM_state.state[0];
slouken@0
   141
	state[1] = &MS_ADPCM_state.state[stereo];
slouken@0
   142
	while ( encoded_len >= MS_ADPCM_state.wavefmt.blockalign ) {
slouken@0
   143
		/* Grab the initial information for this block */
slouken@0
   144
		state[0]->hPredictor = *encoded++;
slouken@0
   145
		if ( stereo ) {
slouken@0
   146
			state[1]->hPredictor = *encoded++;
slouken@0
   147
		}
slouken@0
   148
		state[0]->iDelta = ((encoded[1]<<8)|encoded[0]);
slouken@0
   149
		encoded += sizeof(Sint16);
slouken@0
   150
		if ( stereo ) {
slouken@0
   151
			state[1]->iDelta = ((encoded[1]<<8)|encoded[0]);
slouken@0
   152
			encoded += sizeof(Sint16);
slouken@0
   153
		}
slouken@0
   154
		state[0]->iSamp1 = ((encoded[1]<<8)|encoded[0]);
slouken@0
   155
		encoded += sizeof(Sint16);
slouken@0
   156
		if ( stereo ) {
slouken@0
   157
			state[1]->iSamp1 = ((encoded[1]<<8)|encoded[0]);
slouken@0
   158
			encoded += sizeof(Sint16);
slouken@0
   159
		}
slouken@0
   160
		state[0]->iSamp2 = ((encoded[1]<<8)|encoded[0]);
slouken@0
   161
		encoded += sizeof(Sint16);
slouken@0
   162
		if ( stereo ) {
slouken@0
   163
			state[1]->iSamp2 = ((encoded[1]<<8)|encoded[0]);
slouken@0
   164
			encoded += sizeof(Sint16);
slouken@0
   165
		}
slouken@0
   166
		coeff[0] = MS_ADPCM_state.aCoeff[state[0]->hPredictor];
slouken@0
   167
		coeff[1] = MS_ADPCM_state.aCoeff[state[1]->hPredictor];
slouken@0
   168
slouken@0
   169
		/* Store the two initial samples we start with */
slouken@0
   170
		decoded[0] = state[0]->iSamp2&0xFF;
slouken@0
   171
		decoded[1] = state[0]->iSamp2>>8;
slouken@0
   172
		decoded += 2;
slouken@0
   173
		if ( stereo ) {
slouken@0
   174
			decoded[0] = state[1]->iSamp2&0xFF;
slouken@0
   175
			decoded[1] = state[1]->iSamp2>>8;
slouken@0
   176
			decoded += 2;
slouken@0
   177
		}
slouken@0
   178
		decoded[0] = state[0]->iSamp1&0xFF;
slouken@0
   179
		decoded[1] = state[0]->iSamp1>>8;
slouken@0
   180
		decoded += 2;
slouken@0
   181
		if ( stereo ) {
slouken@0
   182
			decoded[0] = state[1]->iSamp1&0xFF;
slouken@0
   183
			decoded[1] = state[1]->iSamp1>>8;
slouken@0
   184
			decoded += 2;
slouken@0
   185
		}
slouken@0
   186
slouken@0
   187
		/* Decode and store the other samples in this block */
slouken@0
   188
		samplesleft = (MS_ADPCM_state.wSamplesPerBlock-2)*
slouken@0
   189
					MS_ADPCM_state.wavefmt.channels;
slouken@0
   190
		while ( samplesleft > 0 ) {
slouken@0
   191
			nybble = (*encoded)>>4;
slouken@0
   192
			new_sample = MS_ADPCM_nibble(state[0],nybble,coeff[0]);
slouken@0
   193
			decoded[0] = new_sample&0xFF;
slouken@0
   194
			new_sample >>= 8;
slouken@0
   195
			decoded[1] = new_sample&0xFF;
slouken@0
   196
			decoded += 2;
slouken@0
   197
slouken@0
   198
			nybble = (*encoded)&0x0F;
slouken@0
   199
			new_sample = MS_ADPCM_nibble(state[1],nybble,coeff[1]);
slouken@0
   200
			decoded[0] = new_sample&0xFF;
slouken@0
   201
			new_sample >>= 8;
slouken@0
   202
			decoded[1] = new_sample&0xFF;
slouken@0
   203
			decoded += 2;
slouken@0
   204
slouken@0
   205
			++encoded;
slouken@0
   206
			samplesleft -= 2;
slouken@0
   207
		}
slouken@0
   208
		encoded_len -= MS_ADPCM_state.wavefmt.blockalign;
slouken@0
   209
	}
slouken@1336
   210
	SDL_free(freeable);
slouken@0
   211
	return(0);
slouken@0
   212
}
slouken@0
   213
slouken@0
   214
struct IMA_ADPCM_decodestate {
slouken@0
   215
	Sint32 sample;
slouken@0
   216
	Sint8 index;
slouken@0
   217
};
slouken@0
   218
static struct IMA_ADPCM_decoder {
slouken@0
   219
	WaveFMT wavefmt;
slouken@0
   220
	Uint16 wSamplesPerBlock;
slouken@0
   221
	/* * * */
slouken@0
   222
	struct IMA_ADPCM_decodestate state[2];
slouken@0
   223
} IMA_ADPCM_state;
slouken@0
   224
slouken@0
   225
static int InitIMA_ADPCM(WaveFMT *format)
slouken@0
   226
{
slouken@0
   227
	Uint8 *rogue_feel;
slouken@0
   228
slouken@0
   229
	/* Set the rogue pointer to the IMA_ADPCM specific data */
slouken@0
   230
	IMA_ADPCM_state.wavefmt.encoding = SDL_SwapLE16(format->encoding);
slouken@0
   231
	IMA_ADPCM_state.wavefmt.channels = SDL_SwapLE16(format->channels);
slouken@0
   232
	IMA_ADPCM_state.wavefmt.frequency = SDL_SwapLE32(format->frequency);
slouken@0
   233
	IMA_ADPCM_state.wavefmt.byterate = SDL_SwapLE32(format->byterate);
slouken@0
   234
	IMA_ADPCM_state.wavefmt.blockalign = SDL_SwapLE16(format->blockalign);
slouken@0
   235
	IMA_ADPCM_state.wavefmt.bitspersample =
slouken@0
   236
					 SDL_SwapLE16(format->bitspersample);
slouken@0
   237
	rogue_feel = (Uint8 *)format+sizeof(*format);
slouken@0
   238
	if ( sizeof(*format) == 16 ) {
slouken@0
   239
		rogue_feel += sizeof(Uint16);
slouken@0
   240
	}
slouken@0
   241
	IMA_ADPCM_state.wSamplesPerBlock = ((rogue_feel[1]<<8)|rogue_feel[0]);
slouken@0
   242
	return(0);
slouken@0
   243
}
slouken@0
   244
slouken@0
   245
static Sint32 IMA_ADPCM_nibble(struct IMA_ADPCM_decodestate *state,Uint8 nybble)
slouken@0
   246
{
slouken@0
   247
	const Sint32 max_audioval = ((1<<(16-1))-1);
slouken@0
   248
	const Sint32 min_audioval = -(1<<(16-1));
slouken@0
   249
	const int index_table[16] = {
slouken@0
   250
		-1, -1, -1, -1,
slouken@0
   251
		 2,  4,  6,  8,
slouken@0
   252
		-1, -1, -1, -1,
slouken@0
   253
		 2,  4,  6,  8
slouken@0
   254
	};
slouken@0
   255
	const Sint32 step_table[89] = {
slouken@0
   256
		7, 8, 9, 10, 11, 12, 13, 14, 16, 17, 19, 21, 23, 25, 28, 31,
slouken@0
   257
		34, 37, 41, 45, 50, 55, 60, 66, 73, 80, 88, 97, 107, 118, 130,
slouken@0
   258
		143, 157, 173, 190, 209, 230, 253, 279, 307, 337, 371, 408,
slouken@0
   259
		449, 494, 544, 598, 658, 724, 796, 876, 963, 1060, 1166, 1282,
slouken@0
   260
		1411, 1552, 1707, 1878, 2066, 2272, 2499, 2749, 3024, 3327,
slouken@0
   261
		3660, 4026, 4428, 4871, 5358, 5894, 6484, 7132, 7845, 8630,
slouken@0
   262
		9493, 10442, 11487, 12635, 13899, 15289, 16818, 18500, 20350,
slouken@0
   263
		22385, 24623, 27086, 29794, 32767
slouken@0
   264
	};
slouken@0
   265
	Sint32 delta, step;
slouken@0
   266
ppisar@12800
   267
	/* Clamp index value. The inital value can be invalid. */
ppisar@12800
   268
	if ( state->index > 88 ) {
ppisar@12800
   269
		state->index = 88;
ppisar@12800
   270
	} else
ppisar@12800
   271
	if ( state->index < 0 ) {
ppisar@12800
   272
		state->index = 0;
ppisar@12800
   273
	}
ppisar@12800
   274
slouken@0
   275
	/* Compute difference and new sample value */
slouken@0
   276
	step = step_table[state->index];
slouken@0
   277
	delta = step >> 3;
slouken@0
   278
	if ( nybble & 0x04 ) delta += step;
slouken@0
   279
	if ( nybble & 0x02 ) delta += (step >> 1);
slouken@0
   280
	if ( nybble & 0x01 ) delta += (step >> 2);
slouken@0
   281
	if ( nybble & 0x08 ) delta = -delta;
slouken@0
   282
	state->sample += delta;
slouken@0
   283
slouken@0
   284
	/* Update index value */
slouken@0
   285
	state->index += index_table[nybble];
slouken@0
   286
slouken@0
   287
	/* Clamp output sample */
slouken@0
   288
	if ( state->sample > max_audioval ) {
slouken@0
   289
		state->sample = max_audioval;
slouken@0
   290
	} else
slouken@0
   291
	if ( state->sample < min_audioval ) {
slouken@0
   292
		state->sample = min_audioval;
slouken@0
   293
	}
slouken@0
   294
	return(state->sample);
slouken@0
   295
}
slouken@0
   296
slouken@0
   297
/* Fill the decode buffer with a channel block of data (8 samples) */
slouken@0
   298
static void Fill_IMA_ADPCM_block(Uint8 *decoded, Uint8 *encoded,
slouken@0
   299
	int channel, int numchannels, struct IMA_ADPCM_decodestate *state)
slouken@0
   300
{
slouken@0
   301
	int i;
slouken@0
   302
	Sint8 nybble;
slouken@0
   303
	Sint32 new_sample;
slouken@0
   304
slouken@0
   305
	decoded += (channel * 2);
slouken@0
   306
	for ( i=0; i<4; ++i ) {
slouken@0
   307
		nybble = (*encoded)&0x0F;
slouken@0
   308
		new_sample = IMA_ADPCM_nibble(state, nybble);
slouken@0
   309
		decoded[0] = new_sample&0xFF;
slouken@0
   310
		new_sample >>= 8;
slouken@0
   311
		decoded[1] = new_sample&0xFF;
slouken@0
   312
		decoded += 2 * numchannels;
slouken@0
   313
slouken@0
   314
		nybble = (*encoded)>>4;
slouken@0
   315
		new_sample = IMA_ADPCM_nibble(state, nybble);
slouken@0
   316
		decoded[0] = new_sample&0xFF;
slouken@0
   317
		new_sample >>= 8;
slouken@0
   318
		decoded[1] = new_sample&0xFF;
slouken@0
   319
		decoded += 2 * numchannels;
slouken@0
   320
slouken@0
   321
		++encoded;
slouken@0
   322
	}
slouken@0
   323
}
slouken@0
   324
slouken@0
   325
static int IMA_ADPCM_decode(Uint8 **audio_buf, Uint32 *audio_len)
slouken@0
   326
{
slouken@0
   327
	struct IMA_ADPCM_decodestate *state;
slouken@0
   328
	Uint8 *freeable, *encoded, *decoded;
slouken@0
   329
	Sint32 encoded_len, samplesleft;
slouken@1612
   330
	unsigned int c, channels;
slouken@0
   331
slouken@0
   332
	/* Check to make sure we have enough variables in the state array */
slouken@0
   333
	channels = IMA_ADPCM_state.wavefmt.channels;
slouken@1330
   334
	if ( channels > SDL_arraysize(IMA_ADPCM_state.state) ) {
slouken@0
   335
		SDL_SetError("IMA ADPCM decoder can only handle %d channels",
slouken@1330
   336
					SDL_arraysize(IMA_ADPCM_state.state));
slouken@0
   337
		return(-1);
slouken@0
   338
	}
slouken@0
   339
	state = IMA_ADPCM_state.state;
slouken@0
   340
slouken@0
   341
	/* Allocate the proper sized output buffer */
slouken@0
   342
	encoded_len = *audio_len;
slouken@0
   343
	encoded = *audio_buf;
slouken@0
   344
	freeable = *audio_buf;
slouken@0
   345
	*audio_len = (encoded_len/IMA_ADPCM_state.wavefmt.blockalign) * 
slouken@0
   346
				IMA_ADPCM_state.wSamplesPerBlock*
slouken@0
   347
				IMA_ADPCM_state.wavefmt.channels*sizeof(Sint16);
slouken@1336
   348
	*audio_buf = (Uint8 *)SDL_malloc(*audio_len);
slouken@0
   349
	if ( *audio_buf == NULL ) {
slouken@0
   350
		SDL_Error(SDL_ENOMEM);
slouken@0
   351
		return(-1);
slouken@0
   352
	}
slouken@0
   353
	decoded = *audio_buf;
slouken@0
   354
slouken@0
   355
	/* Get ready... Go! */
slouken@0
   356
	while ( encoded_len >= IMA_ADPCM_state.wavefmt.blockalign ) {
slouken@0
   357
		/* Grab the initial information for this block */
slouken@0
   358
		for ( c=0; c<channels; ++c ) {
slouken@0
   359
			/* Fill the state information for this block */
slouken@0
   360
			state[c].sample = ((encoded[1]<<8)|encoded[0]);
slouken@0
   361
			encoded += 2;
slouken@0
   362
			if ( state[c].sample & 0x8000 ) {
slouken@0
   363
				state[c].sample -= 0x10000;
slouken@0
   364
			}
slouken@0
   365
			state[c].index = *encoded++;
slouken@0
   366
			/* Reserved byte in buffer header, should be 0 */
slouken@0
   367
			if ( *encoded++ != 0 ) {
slouken@0
   368
				/* Uh oh, corrupt data?  Buggy code? */;
slouken@0
   369
			}
slouken@0
   370
slouken@0
   371
			/* Store the initial sample we start with */
slouken@1428
   372
			decoded[0] = (Uint8)(state[c].sample&0xFF);
slouken@1428
   373
			decoded[1] = (Uint8)(state[c].sample>>8);
slouken@0
   374
			decoded += 2;
slouken@0
   375
		}
slouken@0
   376
slouken@0
   377
		/* Decode and store the other samples in this block */
slouken@0
   378
		samplesleft = (IMA_ADPCM_state.wSamplesPerBlock-1)*channels;
slouken@0
   379
		while ( samplesleft > 0 ) {
slouken@0
   380
			for ( c=0; c<channels; ++c ) {
slouken@0
   381
				Fill_IMA_ADPCM_block(decoded, encoded,
slouken@0
   382
						c, channels, &state[c]);
slouken@0
   383
				encoded += 4;
slouken@0
   384
				samplesleft -= 8;
slouken@0
   385
			}
slouken@0
   386
			decoded += (channels * 8 * 2);
slouken@0
   387
		}
slouken@0
   388
		encoded_len -= IMA_ADPCM_state.wavefmt.blockalign;
slouken@0
   389
	}
slouken@1336
   390
	SDL_free(freeable);
slouken@0
   391
	return(0);
slouken@0
   392
}
slouken@0
   393
slouken@0
   394
SDL_AudioSpec * SDL_LoadWAV_RW (SDL_RWops *src, int freesrc,
slouken@0
   395
		SDL_AudioSpec *spec, Uint8 **audio_buf, Uint32 *audio_len)
slouken@0
   396
{
slouken@0
   397
	int was_error;
slouken@0
   398
	Chunk chunk;
slouken@0
   399
	int lenread;
slouken@0
   400
	int MS_ADPCM_encoded, IMA_ADPCM_encoded;
slouken@0
   401
	int samplesize;
slouken@0
   402
slouken@0
   403
	/* WAV magic header */
slouken@0
   404
	Uint32 RIFFchunk;
slouken@1260
   405
	Uint32 wavelen = 0;
slouken@0
   406
	Uint32 WAVEmagic;
slouken@1260
   407
	Uint32 headerDiff = 0;
slouken@0
   408
slouken@0
   409
	/* FMT chunk */
slouken@0
   410
	WaveFMT *format = NULL;
slouken@0
   411
slouken@0
   412
	/* Make sure we are passed a valid data source */
slouken@0
   413
	was_error = 0;
slouken@0
   414
	if ( src == NULL ) {
slouken@0
   415
		was_error = 1;
slouken@0
   416
		goto done;
slouken@0
   417
	}
slouken@0
   418
		
slouken@0
   419
	/* Check the magic header */
slouken@0
   420
	RIFFchunk	= SDL_ReadLE32(src);
slouken@0
   421
	wavelen		= SDL_ReadLE32(src);
slouken@171
   422
	if ( wavelen == WAVE ) { /* The RIFFchunk has already been read */
slouken@171
   423
		WAVEmagic = wavelen;
slouken@171
   424
		wavelen   = RIFFchunk;
slouken@171
   425
		RIFFchunk = RIFF;
slouken@171
   426
	} else {
slouken@171
   427
		WAVEmagic = SDL_ReadLE32(src);
slouken@171
   428
	}
slouken@0
   429
	if ( (RIFFchunk != RIFF) || (WAVEmagic != WAVE) ) {
slouken@0
   430
		SDL_SetError("Unrecognized file type (not WAVE)");
slouken@0
   431
		was_error = 1;
slouken@0
   432
		goto done;
slouken@0
   433
	}
slouken@1487
   434
	headerDiff += sizeof(Uint32); /* for WAVE */
slouken@0
   435
slouken@0
   436
	/* Read the audio data format chunk */
slouken@0
   437
	chunk.data = NULL;
slouken@0
   438
	do {
slouken@0
   439
		if ( chunk.data != NULL ) {
slouken@1336
   440
			SDL_free(chunk.data);
slouken@4158
   441
			chunk.data = NULL;
slouken@0
   442
		}
slouken@0
   443
		lenread = ReadChunk(src, &chunk);
slouken@0
   444
		if ( lenread < 0 ) {
slouken@0
   445
			was_error = 1;
slouken@0
   446
			goto done;
slouken@0
   447
		}
slouken@1487
   448
		/* 2 Uint32's for chunk header+len, plus the lenread */
slouken@1260
   449
		headerDiff += lenread + 2 * sizeof(Uint32);
slouken@0
   450
	} while ( (chunk.magic == FACT) || (chunk.magic == LIST) );
slouken@0
   451
slouken@0
   452
	/* Decode the audio data format */
slouken@0
   453
	format = (WaveFMT *)chunk.data;
slouken@0
   454
	if ( chunk.magic != FMT ) {
slouken@0
   455
		SDL_SetError("Complex WAVE files not supported");
slouken@0
   456
		was_error = 1;
slouken@0
   457
		goto done;
slouken@0
   458
	}
slouken@0
   459
	MS_ADPCM_encoded = IMA_ADPCM_encoded = 0;
slouken@0
   460
	switch (SDL_SwapLE16(format->encoding)) {
slouken@0
   461
		case PCM_CODE:
slouken@0
   462
			/* We can understand this */
slouken@0
   463
			break;
slouken@0
   464
		case MS_ADPCM_CODE:
slouken@0
   465
			/* Try to understand this */
slouken@0
   466
			if ( InitMS_ADPCM(format) < 0 ) {
slouken@0
   467
				was_error = 1;
slouken@0
   468
				goto done;
slouken@0
   469
			}
slouken@0
   470
			MS_ADPCM_encoded = 1;
slouken@0
   471
			break;
slouken@0
   472
		case IMA_ADPCM_CODE:
slouken@0
   473
			/* Try to understand this */
slouken@0
   474
			if ( InitIMA_ADPCM(format) < 0 ) {
slouken@0
   475
				was_error = 1;
slouken@0
   476
				goto done;
slouken@0
   477
			}
slouken@0
   478
			IMA_ADPCM_encoded = 1;
slouken@0
   479
			break;
slouken@1818
   480
		case MP3_CODE:
slouken@1818
   481
			SDL_SetError("MPEG Layer 3 data not supported",
slouken@1818
   482
					SDL_SwapLE16(format->encoding));
slouken@1818
   483
			was_error = 1;
slouken@1818
   484
			goto done;
slouken@0
   485
		default:
slouken@0
   486
			SDL_SetError("Unknown WAVE data format: 0x%.4x",
slouken@0
   487
					SDL_SwapLE16(format->encoding));
slouken@0
   488
			was_error = 1;
slouken@0
   489
			goto done;
slouken@0
   490
	}
slouken@1336
   491
	SDL_memset(spec, 0, (sizeof *spec));
slouken@0
   492
	spec->freq = SDL_SwapLE32(format->frequency);
slouken@0
   493
	switch (SDL_SwapLE16(format->bitspersample)) {
slouken@0
   494
		case 4:
slouken@0
   495
			if ( MS_ADPCM_encoded || IMA_ADPCM_encoded ) {
slouken@0
   496
				spec->format = AUDIO_S16;
slouken@0
   497
			} else {
slouken@0
   498
				was_error = 1;
slouken@0
   499
			}
slouken@0
   500
			break;
slouken@0
   501
		case 8:
slouken@0
   502
			spec->format = AUDIO_U8;
slouken@0
   503
			break;
slouken@0
   504
		case 16:
slouken@0
   505
			spec->format = AUDIO_S16;
slouken@0
   506
			break;
slouken@0
   507
		default:
slouken@0
   508
			was_error = 1;
slouken@0
   509
			break;
slouken@0
   510
	}
slouken@0
   511
	if ( was_error ) {
slouken@0
   512
		SDL_SetError("Unknown %d-bit PCM data format",
slouken@0
   513
			SDL_SwapLE16(format->bitspersample));
slouken@0
   514
		goto done;
slouken@0
   515
	}
slouken@0
   516
	spec->channels = (Uint8)SDL_SwapLE16(format->channels);
slouken@0
   517
	spec->samples = 4096;		/* Good default buffer size */
slouken@0
   518
slouken@0
   519
	/* Read the audio data chunk */
slouken@0
   520
	*audio_buf = NULL;
slouken@0
   521
	do {
slouken@0
   522
		if ( *audio_buf != NULL ) {
slouken@1336
   523
			SDL_free(*audio_buf);
slouken@4158
   524
			*audio_buf = NULL;
slouken@0
   525
		}
slouken@0
   526
		lenread = ReadChunk(src, &chunk);
slouken@0
   527
		if ( lenread < 0 ) {
slouken@0
   528
			was_error = 1;
slouken@0
   529
			goto done;
slouken@0
   530
		}
slouken@0
   531
		*audio_len = lenread;
slouken@0
   532
		*audio_buf = chunk.data;
slouken@1260
   533
		if(chunk.magic != DATA) headerDiff += lenread + 2 * sizeof(Uint32);
slouken@0
   534
	} while ( chunk.magic != DATA );
slouken@1487
   535
	headerDiff += 2 * sizeof(Uint32); /* for the data chunk and len */
slouken@0
   536
slouken@0
   537
	if ( MS_ADPCM_encoded ) {
slouken@0
   538
		if ( MS_ADPCM_decode(audio_buf, audio_len) < 0 ) {
slouken@0
   539
			was_error = 1;
slouken@0
   540
			goto done;
slouken@0
   541
		}
slouken@0
   542
	}
slouken@0
   543
	if ( IMA_ADPCM_encoded ) {
slouken@0
   544
		if ( IMA_ADPCM_decode(audio_buf, audio_len) < 0 ) {
slouken@0
   545
			was_error = 1;
slouken@0
   546
			goto done;
slouken@0
   547
		}
slouken@0
   548
	}
slouken@0
   549
slouken@0
   550
	/* Don't return a buffer that isn't a multiple of samplesize */
slouken@0
   551
	samplesize = ((spec->format & 0xFF)/8)*spec->channels;
slouken@0
   552
	*audio_len &= ~(samplesize-1);
slouken@0
   553
slouken@0
   554
done:
slouken@0
   555
	if ( format != NULL ) {
slouken@1336
   556
		SDL_free(format);
slouken@0
   557
	}
slouken@1465
   558
	if ( src ) {
slouken@1465
   559
		if ( freesrc ) {
slouken@1465
   560
			SDL_RWclose(src);
slouken@1465
   561
		} else {
slouken@1487
   562
			/* seek to the end of the file (given by the RIFF chunk) */
slouken@1465
   563
			SDL_RWseek(src, wavelen - chunk.length - headerDiff, RW_SEEK_CUR);
slouken@1465
   564
		}
slouken@1260
   565
	}
slouken@0
   566
	if ( was_error ) {
slouken@0
   567
		spec = NULL;
slouken@0
   568
	}
slouken@0
   569
	return(spec);
slouken@0
   570
}
slouken@0
   571
slouken@0
   572
/* Since the WAV memory is allocated in the shared library, it must also
slouken@0
   573
   be freed here.  (Necessary under Win32, VC++)
slouken@0
   574
 */
slouken@0
   575
void SDL_FreeWAV(Uint8 *audio_buf)
slouken@0
   576
{
slouken@0
   577
	if ( audio_buf != NULL ) {
slouken@1336
   578
		SDL_free(audio_buf);
slouken@0
   579
	}
slouken@0
   580
}
slouken@0
   581
slouken@0
   582
static int ReadChunk(SDL_RWops *src, Chunk *chunk)
slouken@0
   583
{
slouken@0
   584
	chunk->magic	= SDL_ReadLE32(src);
slouken@0
   585
	chunk->length	= SDL_ReadLE32(src);
slouken@1336
   586
	chunk->data = (Uint8 *)SDL_malloc(chunk->length);
slouken@0
   587
	if ( chunk->data == NULL ) {
slouken@0
   588
		SDL_Error(SDL_ENOMEM);
slouken@0
   589
		return(-1);
slouken@0
   590
	}
slouken@0
   591
	if ( SDL_RWread(src, chunk->data, chunk->length, 1) != 1 ) {
slouken@0
   592
		SDL_Error(SDL_EFREAD);
slouken@1336
   593
		SDL_free(chunk->data);
slouken@4158
   594
		chunk->data = NULL;
slouken@0
   595
		return(-1);
slouken@0
   596
	}
slouken@0
   597
	return(chunk->length);
slouken@0
   598
}