diff -ur libsndfile-1.0.18-orig/src/aiff.c libsndfile-1.0.18/src/aiff.c --- libsndfile-1.0.18-orig/src/aiff.c 2009-02-07 14:57:23.000000000 +1100 +++ libsndfile-1.0.18/src/aiff.c 2009-04-27 19:14:55.000000000 +1000 @@ -758,7 +758,6 @@ pchk4_store (&paiff->chunk4, marker, psf_ftell (psf) - 8, dword) ; psf_log_printf (psf, " %M : %d\n", marker, dword) ; { unsigned short mark_id, n = 0 ; - unsigned char pstr_len ; unsigned int position ; bytesread = psf_binheader_readf (psf, "E2", &n) ; @@ -767,13 +766,24 @@ psf_log_printf (psf, " Count : %d\n", mark_count) ; for (n = 0 ; n < mark_count && bytesread < dword ; n++) - { bytesread += psf_binheader_readf (psf, "E241", &mark_id, &position, &pstr_len) ; + { unsigned int pstr_len ; + unsigned char ch ; + + bytesread += psf_binheader_readf (psf, "E241", &mark_id, &position, &ch) ; psf_log_printf (psf, " Mark ID : %u\n Position : %u\n", mark_id, position) ; - pstr_len += (pstr_len & 1) ? 0 : 1 ; + pstr_len = (ch & 1) ? ch : ch + 1 ; + + if (pstr_len < sizeof (psf->u.scbuf) - 1) + { bytesread += psf_binheader_readf (psf, "b", psf->u.scbuf, pstr_len) ; + psf->u.scbuf [pstr_len] = 0 ; + } + else + { unsigned int read_len = pstr_len - (sizeof (psf->u.scbuf) - 1) ; + bytesread += psf_binheader_readf (psf, "bj", psf->u.scbuf, read_len, pstr_len - read_len) ; + psf->u.scbuf [sizeof (psf->u.scbuf) - 1] = 0 ; + } - bytesread += psf_binheader_readf (psf, "b", psf->u.scbuf, pstr_len) ; - psf->u.scbuf [pstr_len] = 0 ; psf_log_printf (psf, " Name : %s\n", psf->u.scbuf) ; markstr [n].markerID = mark_id ; diff -ur libsndfile-1.0.18-orig/src/voc.c libsndfile-1.0.18/src/voc.c --- libsndfile-1.0.18-orig/src/voc.c 2009-02-07 14:54:20.000000000 +1100 +++ libsndfile-1.0.18/src/voc.c 2009-04-27 19:14:55.000000000 +1000 @@ -199,7 +199,7 @@ psf->endian = SF_ENDIAN_LITTLE ; while (1) - { int size ; + { unsigned size ; short count ; block_type = 0 ; @@ -211,9 +211,14 @@ psf_log_printf (psf, " ASCII : %d\n", size) ; - offset += psf_binheader_readf (psf, "b", psf->header, size) ; - psf->header [size] = 0 ; - psf_log_printf (psf, " text : %s\n", psf->header) ; + if (size < sizeof (psf->header) - 1) + { offset += psf_binheader_readf (psf, "b", psf->header, size) ; + psf->header [size] = 0 ; + psf_log_printf (psf, " text : %s\n", psf->header) ; + continue ; + } + + offset += psf_binheader_readf (psf, "j", size) ; continue ; case VOC_REPEAT :