annotate libdvdread/libdvdread_changes.diff @ 28115:1a9b1b7e285f

Add extra checks to avoid crashes with broken vqf files. Fixes CVE-2008-5616

--- dvdread.orig/dvd_reader.c	2007-08-06 13:34:37.000000000 +0200
+++ dvdread/dvd_reader.c	2007-08-06 13:35:19.000000000 +0200
@@ -39,9 +43,11 @@
 
 #if defined(__sun)
 #include <sys/mnttab.h>
+#elif defined(hpux)
+#include </usr/conf/h/mnttab.h>
 #elif defined(SYS_BSD)
 #include <fstab.h>
-#elif defined(__linux__)
+#elif defined(__linux__) || defined(__CYGWIN__)
 #include <mntent.h>
 #endif
 
@@ -52,7 +58,7 @@
 
 #include "dvdread_internal.h"
 
-#define DEFAULT_UDF_CACHE_LEVEL 1
+#define DEFAULT_UDF_CACHE_LEVEL 0
 
 struct dvd_reader_s {
   /* Basic information. */
@@ -183,19 +189,7 @@
   dev->align = align;
 }
 
-#ifdef WIN32 /* replacement gettimeofday implementation */
-#include <sys/timeb.h>
-static int gettimeofday( struct timeval *tv, void *tz )
-{
-  struct timeb t;
-  ftime( &t );
-  tv->tv_sec = t.time;
-  tv->tv_usec = t.millitm * 1000;
-  return 0;
-}
-#endif
 
-
 /* Loop over all titles and call dvdcss_title to crack the keys. */
 static int initAllCSSKeys( dvd_reader_t *dvd )
 {
@@ -438,7 +438,7 @@
   
   verbose = get_verbose();
 
-#ifdef WIN32
+#if defined(__CYGWIN__) || defined(__MINGW32__)
   /* Stat doesn't work on devices under mingwin/cygwin. */
   if( path[0] && path[1] == ':' && path[2] == '\0' )
     {
@@ -494,7 +488,7 @@
     char *path_copy;
 #if defined(SYS_BSD)
     struct fstab* fe;
-#elif defined(__sun) || defined(__linux__)
+#elif defined(__sun) || defined(__linux__) || defined(__CYGWIN__)
     FILE *mntfile;
 #endif
 
@@ -495,7 +495,8 @@
     /* XXX: We should scream real loud here. */
     if( !(path_copy = strdup( path ) ) ) return 0;
 
-#ifndef WIN32 /* don't have fchdir, and getcwd( NULL, ... ) is strange */
+/* don't have fchdir, and getcwd( NULL, ... ) is strange */
+#if !(defined(__CYGWIN__) || defined(__MINGW32__))
     /* Resolve any symlinks and get the absolut dir name. */
     {
       char *new_path;
@@ -597,7 +592,7 @@
       }
       fclose( mntfile );
     }
-#elif defined(__linux__)
+#elif defined(__linux__) || defined(__CYGWIN__)
     mntfile = fopen( MOUNTED, "r" );
     if( mntfile ) {
       struct mntent *me;
@@ -623,6 +617,9 @@
       }
       fclose( mntfile );
     }
+#elif defined(__MINGW32__)
+    dev_name = strdup(path);
+    auth_drive = DVDOpenImageFile( path, have_css );
 #endif
     if( !dev_name ) {
       if(verbose >= 1) {
@@ -841,8 +838,8 @@
   }
     
   if( dvd->css_state == 1 /* Need key init */ ) {
-    initAllCSSKeys( dvd );
-    dvd->css_state = 2;
+//    initAllCSSKeys( dvd );
+//    dvd->css_state = 2;
   }
   /*    
         if( dvdinput_title( dvd_file->dvd->dev, (int)start ) < 0 ) {

--- dvdread.orig/dvdread_internal.h	2005-09-12 21:42:12.000000000 +0200
+++ dvdread/dvdread_internal.h	2007-08-06 12:57:08.000000000 +0200
@@ -3,12 +3,7 @@
 #define DVDREAD_INTERNAL_H
 
 
-#define CHECK_VALUE(arg)                                                \
-  if(!(arg)) {                                                          \
-    fprintf(stderr, "\n*** libdvdread: CHECK_VALUE failed in %s:%i ***" \
-            "\n*** for %s ***\n\n",                                     \
-            __FILE__, __LINE__, # arg );                                \
-  }
+#define CHECK_VALUE(arg)
 
 
 int get_verbose(void);

--- dvdread.orig/ifo_print.c	2005-09-15 18:54:29.000000000 +0200
+++ dvdread/ifo_print.c	2007-08-06 12:52:32.000000000 +0200
@@ -793,14 +797,14 @@
   ifoPrint_USER_OPS(&pgc->prohibited_ops);
   
   for(i = 0; i < 8; i++) {
-    if(pgc->audio_control[i] & 0x8000) { /* The 'is present' bit */
+    if(pgc->audio_control[i].present) { /* The 'is present' bit */
       printf("Audio stream %i control: %04x\n", 
              i, pgc->audio_control[i]);
     }
   }
   
   for(i = 0; i < 32; i++) {
-    if(pgc->subp_control[i] & 0x80000000) { /* The 'is present' bit */
+    if(pgc->subp_control[i].present) { /* The 'is present' bit */
       printf("Subpicture stream %2i control: %08x\n", 
              i, pgc->subp_control[i]);
     }

--- dvdread.orig/ifo_read.c	2006-01-22 13:19:19.000000000 +0100
+++ dvdread/ifo_read.c	2007-08-06 13:15:55.000000000 +0200
@@ -110,7 +114,7 @@
 ifo_handle_t *ifoOpen(dvd_reader_t *dvd, int title) {
   ifo_handle_t *ifofile;
 
-  ifofile = (ifo_handle_t *)malloc(sizeof(ifo_handle_t));
+  ifofile = malloc(sizeof(ifo_handle_t));
   if(!ifofile)
     return NULL;
 
@@ -240,7 +244,7 @@
 ifo_handle_t *ifoOpenVMGI(dvd_reader_t *dvd) {
   ifo_handle_t *ifofile;
 
-  ifofile = (ifo_handle_t *)malloc(sizeof(ifo_handle_t));
+  ifofile = malloc(sizeof(ifo_handle_t));
   if(!ifofile)
     return NULL;
 
@@ -292,7 +296,7 @@
 ifo_handle_t *ifoOpenVTSI(dvd_reader_t *dvd, int title) {
   ifo_handle_t *ifofile;
   
-  ifofile = (ifo_handle_t *)malloc(sizeof(ifo_handle_t));
+  ifofile = malloc(sizeof(ifo_handle_t));
   if(!ifofile)
     return NULL;
 
@@ -382,7 +386,7 @@
 static int ifoRead_VMG(ifo_handle_t *ifofile) {
   vmgi_mat_t *vmgi_mat;
 
-  vmgi_mat = (vmgi_mat_t *)malloc(sizeof(vmgi_mat_t));
+  vmgi_mat = malloc(sizeof(vmgi_mat_t));
   if(!vmgi_mat)
     return 0;
 
@@ -473,7 +477,7 @@
   vtsi_mat_t *vtsi_mat;
   int i;
 
-  vtsi_mat = (vtsi_mat_t *)malloc(sizeof(vtsi_mat_t));
+  vtsi_mat = malloc(sizeof(vtsi_mat_t));
   if(!vtsi_mat)
     return 0;
   
@@ -606,7 +610,7 @@
 
   if(cmd_tbl->nr_of_pre != 0) {
     unsigned int pre_cmds_size  = cmd_tbl->nr_of_pre * COMMAND_DATA_SIZE;
-    cmd_tbl->pre_cmds = (vm_cmd_t *)malloc(pre_cmds_size);
+    cmd_tbl->pre_cmds = malloc(pre_cmds_size);
     if(!cmd_tbl->pre_cmds)
       return 0;
 
@@ -618,7 +622,7 @@
 
   if(cmd_tbl->nr_of_post != 0) {
     unsigned int post_cmds_size = cmd_tbl->nr_of_post * COMMAND_DATA_SIZE;
-    cmd_tbl->post_cmds = (vm_cmd_t *)malloc(post_cmds_size);
+    cmd_tbl->post_cmds = malloc(post_cmds_size);
     if(!cmd_tbl->post_cmds) {
       if(cmd_tbl->pre_cmds) 
         free(cmd_tbl->pre_cmds);
@@ -634,7 +638,7 @@
 
   if(cmd_tbl->nr_of_cell != 0) {
     unsigned int cell_cmds_size = cmd_tbl->nr_of_cell * COMMAND_DATA_SIZE;
-    cmd_tbl->cell_cmds = (vm_cmd_t *)malloc(cell_cmds_size);
+    cmd_tbl->cell_cmds = malloc(cell_cmds_size);
     if(!cmd_tbl->cell_cmds) {
       if(cmd_tbl->pre_cmds)
         free(cmd_tbl->pre_cmds);
@@ -751,10 +755,6 @@
   B2N_16(pgc->cell_playback_offset);
   B2N_16(pgc->cell_position_offset);
 
-  for(i = 0; i < 8; i++)
-    B2N_16(pgc->audio_control[i]);
-  for(i = 0; i < 32; i++)
-    B2N_32(pgc->subp_control[i]);
   for(i = 0; i < 16; i++)
     B2N_32(pgc->palette[i]);
   
@@ -763,10 +763,10 @@
 
   /* verify time (look at print_time) */
   for(i = 0; i < 8; i++)
-    if(!pgc->audio_control[i] & 0x8000) /* The 'is present' bit */
+    if(!pgc->audio_control[i].present)
       CHECK_ZERO(pgc->audio_control[i]);
   for(i = 0; i < 32; i++)
-    if(!pgc->subp_control[i] & 0x80000000) /* The 'is present' bit */
+    if(!pgc->subp_control[i].present)
       CHECK_ZERO(pgc->subp_control[i]);
   
   /* Check that time is 0:0:0:0 also if nr_of_programs == 0 */
@@ -880,7 +880,7 @@
   if(ifofile->vmgi_mat->first_play_pgc == 0)
     return 1;
   
-  ifofile->first_play_pgc = (pgc_t *)malloc(sizeof(pgc_t));
+  ifofile->first_play_pgc = malloc(sizeof(pgc_t));
   if(!ifofile->first_play_pgc)
     return 0;
   
@@ -934,7 +934,7 @@
   if(!DVDFileSeek_(ifofile->file, ifofile->vmgi_mat->tt_srpt * DVD_BLOCK_LEN))
     return 0;
 
-  tt_srpt = (tt_srpt_t *)malloc(sizeof(tt_srpt_t));
+  tt_srpt = malloc(sizeof(tt_srpt_t));
   if(!tt_srpt)
     return 0;
 
@@ -953,7 +953,7 @@
   
   info_length = tt_srpt->last_byte + 1 - TT_SRPT_SIZE;
 
-  tt_srpt->title = (title_info_t *)malloc(info_length); 
+  tt_srpt->title = malloc(info_length);
   if(!tt_srpt->title) {
     free(tt_srpt);
     ifofile->tt_srpt = 0;
@@ -1040,7 +1040,7 @@
                    ifofile->vtsi_mat->vts_ptt_srpt * DVD_BLOCK_LEN))
     return 0;
 
-  vts_ptt_srpt = (vts_ptt_srpt_t *)malloc(sizeof(vts_ptt_srpt_t));
+  vts_ptt_srpt = malloc(sizeof(vts_ptt_srpt_t));
   if(!vts_ptt_srpt)
     return 0;
 
@@ -1063,7 +1063,7 @@
   
   info_length = vts_ptt_srpt->last_byte + 1 - VTS_PTT_SRPT_SIZE;
   
-  data = (uint32_t *)malloc(info_length); 
+  data = malloc(info_length);
   if(!data) {
     free(vts_ptt_srpt);
     ifofile->vts_ptt_srpt = 0;
@@ -1183,7 +1183,7 @@
   if(!DVDFileSeek_(ifofile->file, ifofile->vmgi_mat->ptl_mait * DVD_BLOCK_LEN))
     return 0;
 
-  ptl_mait = (ptl_mait_t *)malloc(sizeof(ptl_mait_t));
+  ptl_mait = malloc(sizeof(ptl_mait_t));
   if(!ptl_mait)
     return 0;
 
@@ -1207,7 +1207,7 @@
               <= ptl_mait->last_byte + 1 - PTL_MAIT_SIZE);
   
   info_length = ptl_mait->nr_of_countries * sizeof(ptl_mait_country_t);
-  ptl_mait->countries = (ptl_mait_country_t *)malloc(info_length);
+  ptl_mait->countries = malloc(info_length);
   if(!ptl_mait->countries) {
     free(ptl_mait);
     ifofile->ptl_mait = 0;
@@ -1252,7 +1252,7 @@
       return 0;
     }
     info_length = (ptl_mait->nr_of_vtss + 1) * sizeof(pf_level_t);
-    pf_temp = (uint16_t *)malloc(info_length);
+    pf_temp = malloc(info_length);
     if(!pf_temp) {
       for(j = 0; j < i ; j++) {
         free(ptl_mait->countries[j].pf_ptl_mai);
@@ -1276,7 +1276,7 @@
     for (j = 0; j < ((ptl_mait->nr_of_vtss + 1) * 8); j++) {
       B2N_16(pf_temp[j]);
     }
-    ptl_mait->countries[i].pf_ptl_mai = (pf_level_t *)malloc(info_length);
+    ptl_mait->countries[i].pf_ptl_mai = malloc(info_length);
     if(!ptl_mait->countries[i].pf_ptl_mai) {
       free(pf_temp);
       for(j = 0; j < i ; j++) {
@@ -1340,7 +1340,7 @@
   if(!DVDFileSeek_(ifofile->file, offset)) 
     return 0;
   
-  vts_tmapt = (vts_tmapt_t *)malloc(sizeof(vts_tmapt_t));
+  vts_tmapt = malloc(sizeof(vts_tmapt_t));
   if(!vts_tmapt)
     return 0;
   
@@ -1362,7 +1362,7 @@
   
   info_length = vts_tmapt->nr_of_tmaps * 4;
   
-  vts_tmap_srp = (uint32_t *)malloc(info_length);
+  vts_tmap_srp = malloc(info_length);
   if(!vts_tmap_srp) {
     free(vts_tmapt);
     ifofile->vts_tmapt = NULL;
@@ -1388,7 +1388,7 @@
   
   info_length = vts_tmapt->nr_of_tmaps * sizeof(vts_tmap_t);
   
-  vts_tmapt->tmap = (vts_tmap_t *)malloc(info_length);
+  vts_tmapt->tmap = malloc(info_length);
   if(!vts_tmapt->tmap) {
     free(vts_tmap_srp);
     free(vts_tmapt);
@@ -1422,7 +1422,7 @@
     
     info_length = vts_tmapt->tmap[i].nr_of_entries * sizeof(map_ent_t);
     
-    vts_tmapt->tmap[i].map_ent = (map_ent_t *)malloc(info_length);
+    vts_tmapt->tmap[i].map_ent = malloc(info_length);
     if(!vts_tmapt->tmap[i].map_ent) {
       ifoFree_VTS_TMAPT(ifofile);
       return 0;
@@ -1472,7 +1472,7 @@
   if(ifofile->vtsi_mat->vts_c_adt == 0) /* mandatory */
     return 0;
 
-  ifofile->vts_c_adt = (c_adt_t *)malloc(sizeof(c_adt_t));
+  ifofile->vts_c_adt = malloc(sizeof(c_adt_t));
   if(!ifofile->vts_c_adt)
     return 0;
 
@@ -1504,7 +1504,7 @@
     return 0;
   }
   
-  ifofile->menu_c_adt = (c_adt_t *)malloc(sizeof(c_adt_t));
+  ifofile->menu_c_adt = malloc(sizeof(c_adt_t));
   if(!ifofile->menu_c_adt)
     return 0;
 
@@ -1548,7 +1548,7 @@
     c_adt->nr_of_vobs = info_length / sizeof(cell_adr_t);
   }
   
-  c_adt->cell_adr_table = (cell_adr_t *)malloc(info_length);
+  c_adt->cell_adr_table = malloc(info_length);
   if(!c_adt->cell_adr_table)
     return 0;
 
@@ -1608,7 +1608,7 @@
   if(ifofile->vtsi_mat->vts_vobu_admap == 0) /* mandatory */
     return 0;
   
-  ifofile->vts_vobu_admap = (vobu_admap_t *)malloc(sizeof(vobu_admap_t));
+  ifofile->vts_vobu_admap = malloc(sizeof(vobu_admap_t));
   if(!ifofile->vts_vobu_admap)
     return 0;
 
@@ -1640,7 +1640,7 @@
     return 0;
   }
   
-  ifofile->menu_vobu_admap = (vobu_admap_t *)malloc(sizeof(vobu_admap_t));
+  ifofile->menu_vobu_admap = malloc(sizeof(vobu_admap_t));
   if(!ifofile->menu_vobu_admap)
     return 0;
   
@@ -1673,7 +1673,7 @@
      Titles with a VOBS that has no VOBUs. */
   CHECK_VALUE(info_length % sizeof(uint32_t) == 0);
   
-  vobu_admap->vobu_start_sectors = (uint32_t *)malloc(info_length); 
+  vobu_admap->vobu_start_sectors = malloc(info_length);
   if(!vobu_admap->vobu_start_sectors) {
     return 0;
   }
@@ -1725,7 +1725,7 @@
   if(ifofile->vtsi_mat->vts_pgcit == 0) /* mandatory */
     return 0;
   
-  ifofile->vts_pgcit = (pgcit_t *)malloc(sizeof(pgcit_t));
+  ifofile->vts_pgcit = malloc(sizeof(pgcit_t));
   if(!ifofile->vts_pgcit)
     return 0;
 
@@ -1860,7 +1860,7 @@
     return 0;
   }
   
-  ifofile->pgci_ut = (pgci_ut_t *)malloc(sizeof(pgci_ut_t));
+  ifofile->pgci_ut = malloc(sizeof(pgci_ut_t));
   if(!ifofile->pgci_ut)
     return 0;
   
@@ -2050,7 +2050,7 @@
   if(!DVDFileSeek_(ifofile->file, sector * DVD_BLOCK_LEN))
     return 0;
 
-  vts_atrt = (vts_atrt_t *)malloc(sizeof(vts_atrt_t));
+  vts_atrt = malloc(sizeof(vts_atrt_t));
   if(!vts_atrt)
     return 0;
 
@@ -2072,7 +2072,7 @@
               VTS_ATRT_SIZE < vts_atrt->last_byte + 1);
 
   info_length = vts_atrt->nr_of_vtss * sizeof(uint32_t);
-  data = (uint32_t *)malloc(info_length);
+  data = malloc(info_length);
   if(!data) {
     free(vts_atrt);
     ifofile->vts_atrt = 0;
@@ -2094,7 +2094,7 @@
   }
   
   info_length = vts_atrt->nr_of_vtss * sizeof(vts_attributes_t);
-  vts_atrt->vts = (vts_attributes_t *)malloc(info_length);
+  vts_atrt->vts = malloc(info_length);
   if(!vts_atrt->vts) {
     free(data);
     free(vts_atrt);
@@ -2150,7 +2150,7 @@
                    ifofile->vmgi_mat->txtdt_mgi * DVD_BLOCK_LEN))
     return 0;
   
-  txtdt_mgi = (txtdt_mgi_t *)malloc(sizeof(txtdt_mgi_t));
+  txtdt_mgi = malloc(sizeof(txtdt_mgi_t));
   if(!txtdt_mgi) {
     return 0;
   }

--- dvdread.orig/ifo_types.h	2005-06-23 00:18:54.000000000 +0200
+++ dvdread/ifo_types.h	2005-06-23 00:19:10.000000000 +0200
@@ -403,6 +407,55 @@
 } ATTRIBUTE_PACKED user_ops_t;
 
 /**
+ * Subpicture stream mapping for a subtitle
+ */
+typedef struct {
+#ifdef WORDS_BIGENDIAN
+  unsigned int present   : 1;
+  unsigned int zero1     : 2;
+  unsigned int s_4p3     : 5; /* stream for 4:3 on any display */
+
+  unsigned int zero2     : 3;
+  unsigned int s_wide    : 5; /* stream for 16:9 on widescreen display */
+
+  unsigned int zero3     : 3;
+  unsigned int s_lbox    : 5; /* stream for 16:9 on letterboxed 4:3 display */
+
+  unsigned int zero4     : 3;
+  unsigned int s_panscan : 5; /* stream for 16:9 with pan&scan data on 4:3 display */
+#else
+  unsigned int s_4p3     : 5; /* stream for 4:3 on any display */
+  unsigned int zero1     : 2;
+  unsigned int present   : 1;
+
+  unsigned int s_wide    : 5; /* stream for 16:9 on widescreen display */
+  unsigned int zero2     : 3;
+
+  unsigned int s_lbox    : 5; /* stream for 16:9 on letterboxed 4:3 display */
+  unsigned int zero3     : 3;
+
+  unsigned int s_panscan : 5; /* stream for 16:9 with pan&scan data on 4:3 display */
+  unsigned int zero4     : 3;
+#endif
+} ATTRIBUTE_PACKED subp_mapping_t;
+
+/**
+ * Audio stream mapping for a soundtrack
+ */
+typedef struct {
+#ifdef WORDS_BIGENDIAN
+  unsigned int present : 1;
+  unsigned int zero1   : 4;
+  unsigned int s_audio : 3;
+#else
+  unsigned int s_audio : 3;
+  unsigned int zero1   : 4;
+  unsigned int present : 1;
+#endif
+  uint8_t zero2;
+} ATTRIBUTE_PACKED audio_mapping_t;
+
+/**
  * Program Chain Information.
  */
 typedef struct {
@@ -411,8 +464,8 @@
   uint8_t  nr_of_cells;
   dvd_time_t playback_time;
   user_ops_t prohibited_ops;
-  uint16_t audio_control[8]; /* New type? */
-  uint32_t subp_control[32]; /* New type? */
+  audio_mapping_t audio_control[8];
+  subp_mapping_t subp_control[32];
   uint16_t next_pgc_nr;
   uint16_t prev_pgc_nr;
   uint16_t goup_pgc_nr;
Index: libdvdread/dvd_reader.c
===================================================================
--- libdvdread/dvd_reader.c	(revision 27759)
+++ libdvdread/dvd_reader.c	(working copy)