[Scummvm-git-logs] scummvm master -> ed170da62d436b7c8e373827c08e743c7520408e

[sluicebox]

This automated email contains information about 1 new commit which have been
pushed to the 'scummvm' repo located at https://github.com/scummvm/scummvm .

Summary:
ed170da62d SCI: Validate size in AudioPlayer::getAudioStream()


Commit: ed170da62d436b7c8e373827c08e743c7520408e
    https://github.com/scummvm/scummvm/commit/ed170da62d436b7c8e373827c08e743c7520408e
Author: sluicebox (22204938+sluicebox at users.noreply.github.com)
Date: 2021-06-03T16:56:08-06:00

Commit Message:
SCI: Validate size in AudioPlayer::getAudioStream()

Changed paths:
    engines/sci/sound/audio.cpp


diff --git a/engines/sci/sound/audio.cpp b/engines/sci/sound/audio.cpp
index d1ed276639..042b1cf3ee 100644
--- a/engines/sci/sound/audio.cpp
+++ b/engines/sci/sound/audio.cpp
@@ -426,7 +426,9 @@ Audio::RewindableAudioStream *AudioPlayer::getAudioStream(uint32 number, uint32
 #endif
 	} else {
 		// Original source file
-		if ((audioRes->getUint8At(0) & 0x7f) == kResourceTypeAudio && audioRes->getUint32BEAt(2) == MKTAG('S','O','L',0)) {
+		if (audioRes->size() > 6 &&
+			(audioRes->getUint8At(0) & 0x7f) == kResourceTypeAudio &&
+			audioRes->getUint32BEAt(2) == MKTAG('S','O','L',0)) {
 			// SCI1.1
 			delete memoryStream;
 			const uint8 headerSize = audioRes->getUint8At(1);
@@ -483,13 +485,11 @@ Audio::RewindableAudioStream *AudioPlayer::getAudioStream(uint32 number, uint32
 		*sampleLen = (audioSeekStream->getLength().msecs() * 60) / 1000; // we translate msecs to ticks
 		audioStream = audioSeekStream;
 	}
+
 	// We have to make sure that we don't depend on resource manager pointers
 	// after this point, because the actual audio resource may get unloaded by
 	// resource manager at any time.
-	if (audioStream)
-		return audioStream;
-
-	return NULL;
+	return audioStream;
 }
 
 int AudioPlayer::audioCdPlay(int track, int start, int duration) {