Unified · Split
| @@ -825,7 +825,7 @@ static int it_read_pattern(IT_PATTERN *pattern, DUMBFILE *f, unsigned char *buff · 824 unmodified lines | ||
| 825 | 825 | |
| 826 | 826 | while (bufpos < buflen) { |
| 827 | 827 | unsigned char b = buffer[bufpos++]; |
| 828 | − | |
| 828 | + | |
| 829 | 829 | if (b == 0) { |
| 830 | 830 | /* End of row */ |
| 831 | 831 | IT_SET_END_ROW(entry); |
| @@ -841,31 +841,46 @@ static int it_read_pattern(IT_PATTERN *pattern, DUMBFILE *f, unsigned char *buff · 9 unmodified lines | ||
| 841 | 841 | |
| 842 | 842 | channel = (b - 1) & 63; |
| 843 | 843 | |
| 844 | − if (b & 128) | |
| 844 | + if (b & 128) { | |
| 845 | + if (bufpos >= buflen) | |
| 846 | + return -1; | |
| 847 | + | |
| 845 | 848 | cmask[channel] = mask = buffer[bufpos++]; |
| 846 | − else | |
| 849 | + } else | |
| 847 | 850 | mask = cmask[channel]; |
| 848 | 851 | |
| 849 | 852 | if (mask) { |
| 850 | 853 | entry->mask = (mask & 15) | (mask >> 4); |
| 851 | 854 | entry->channel = channel; |
| 852 | 855 | |
| 853 | − if (mask & IT_ENTRY_NOTE) | |
| 856 | + if (mask & IT_ENTRY_NOTE) { | |
| 857 | + if (bufpos >= buflen) | |
| 858 | + return -1; | |
| 859 | + | |
| 854 | 860 | cnote[channel] = entry->note = buffer[bufpos++]; |
| 855 | − else if (mask & (IT_ENTRY_NOTE << 4)) | |
| 861 | + } else if (mask & (IT_ENTRY_NOTE << 4)) | |
| 856 | 862 | entry->note = cnote[channel]; |
| 857 | 863 | |
| 858 | − if (mask & IT_ENTRY_INSTRUMENT) | |
| 864 | + if (mask & IT_ENTRY_INSTRUMENT) { | |
| 865 | + if (bufpos >= buflen) | |
| 866 | + return -1; | |
| 867 | + | |
| 859 | 868 | cinstrument[channel] = entry->instrument = buffer[bufpos++]; |
| 860 | − else if (mask & (IT_ENTRY_INSTRUMENT << 4)) | |
| 869 | + } else if (mask & (IT_ENTRY_INSTRUMENT << 4)) | |
| 861 | 870 | entry->instrument = cinstrument[channel]; |
| 862 | 871 | |
| 863 | − if (mask & IT_ENTRY_VOLPAN) | |
| 872 | + if (mask & IT_ENTRY_VOLPAN) { | |
| 873 | + if (bufpos >= buflen) | |
| 874 | + return -1; | |
| 875 | + | |
| 864 | 876 | cvolpan[channel] = entry->volpan = buffer[bufpos++]; |
| 865 | − else if (mask & (IT_ENTRY_VOLPAN << 4)) | |
| 877 | + } else if (mask & (IT_ENTRY_VOLPAN << 4)) | |
| 866 | 878 | entry->volpan = cvolpan[channel]; |
| 867 | 879 | |
| 868 | 880 | if (mask & IT_ENTRY_EFFECT) { |
| 881 | + if (bufpos + 1 >= buflen) | |
| 882 | + return -1; | |
| 883 | + | |
| 869 | 884 | ceffect[channel] = entry->effect = buffer[bufpos++]; |
| 870 | 885 | ceffectvalue[channel] = entry->effectvalue = buffer[bufpos++]; |
| 871 | 886 | } else { |