# HG changeset patch
# User reimar
# Date 1170581637 0
# Node ID 0427f8190a128f3e7f7a140233437d21723f53da
# Parent  3525dc2dd7bb179cb788380aa1d56f9d4e84b6ed
Do not read beyond end of data chunk if chunk_size is set.
Sample: http://samples.mplayerhq.hu/A-codecs/wavpcm/ahh.wav

diff -r 3525dc2dd7bb -r 0427f8190a12 libmpdemux/demux_audio.c
--- a/libmpdemux/demux_audio.c	Sun Feb 04 08:18:01 2007 +0000
+++ b/libmpdemux/demux_audio.c	Sun Feb 04 09:33:57 2007 +0000
@@ -454,7 +454,7 @@
         stream_skip(demuxer->stream, chunk_size);
     } while (chunk_type != mmioFOURCC('d', 'a', 't', 'a'));
     demuxer->movi_start = stream_tell(s);
-    demuxer->movi_end = s->end_pos;
+    demuxer->movi_end = chunk_size ? demuxer->movi_start + chunk_size : s->end_pos;
 //    printf("wav: %X .. %X\n",(int)demuxer->movi_start,(int)demuxer->movi_end);
     // Check if it contains dts audio
     if((w->wFormatTag == 0x01) && (w->nChannels == 2) && (w->nSamplesPerSec == 44100)) {
@@ -598,6 +598,11 @@
   case WAV : {
     unsigned align = sh_audio->wf->nBlockAlign;
     l = sh_audio->wf->nAvgBytesPerSec;
+    if (demux->movi_end && l > demux->movi_end - stream_tell(s)) {
+      // do not read beyond end, there might be junk after data chunk
+      l = demux->movi_end - stream_tell(s);
+      if (l <= 0) return 0;
+    }
     if (align)
       l = (l + align - 1) / align * align;
     dp = new_demux_packet(l);