diff --git a/src/add-ons/media/plugins/aiff_reader/aiff_reader.cpp b/src/add-ons/media/plugins/aiff_reader/aiff_reader.cpp index 35ee7a20eb..131efbb92c 100644 --- a/src/add-ons/media/plugins/aiff_reader/aiff_reader.cpp +++ b/src/add-ons/media/plugins/aiff_reader/aiff_reader.cpp @@ -89,6 +89,10 @@ aiffReader::Sniff(int32 *streamCount) return B_ERROR; } pos += sizeof(chunk); + if (UINT32(chunk.chunk_size) == 0) { + TRACE("aiffReader::Sniff: Error: chunk of size 0 found\n"); + return B_ERROR; + } switch (UINT32(chunk.chunk_id)) { case FOURCC('C','O','M','M'): { diff --git a/src/add-ons/media/plugins/avi_reader/libOpenDML/OpenDMLParser.cpp b/src/add-ons/media/plugins/avi_reader/libOpenDML/OpenDMLParser.cpp index 63df829a4c..b2aaf8b6cc 100644 --- a/src/add-ons/media/plugins/avi_reader/libOpenDML/OpenDMLParser.cpp +++ b/src/add-ons/media/plugins/avi_reader/libOpenDML/OpenDMLParser.cpp @@ -142,6 +142,11 @@ OpenDMLParser::Parse(BPositionIO *source) } pos += 4; size = AVI_UINT32(temp); + + if (size == 0) { + TRACE("OpenDMLParser::Parse: Error: chunk of size 0 found\n"); + goto err; + } if (fourcc == FOURCC('J','U','N','K')) { TRACE("OpenDMLParser::Parse: JUNK chunk ignored, size: %lu bytes\n", size); diff --git a/src/add-ons/media/plugins/wav_reader/WavReaderPlugin.cpp b/src/add-ons/media/plugins/wav_reader/WavReaderPlugin.cpp index de4edb8d04..e61c4a8576 100644 --- a/src/add-ons/media/plugins/wav_reader/WavReaderPlugin.cpp +++ b/src/add-ons/media/plugins/wav_reader/WavReaderPlugin.cpp @@ -100,6 +100,10 @@ WavReader::Sniff(int32 *streamCount) return B_ERROR; } pos += sizeof(chunk); + if (UINT32(chunk.len) == 0) { + TRACE("WavReader::Sniff: Error: chunk of size 0 found\n"); + return B_ERROR; + } switch (UINT32(chunk.fourcc)) { case FOURCC('f','m','t',' '): if (UINT32(chunk.len) >= sizeof(format)) {