minimp3: Fix buffer overrun when reading MP3 files

Signed-off-by: Christopher Snowhill <kode54@gmail.com>

Frameworks/vgmstream/vgmstream/src/coding/libs/minimp3.h

@@ -176,7 +176,7 @@ end:
 #define VMUL_S(x, s)  vmulq_f32(x, vmovq_n_f32(s))
 #define VREV(x) vcombine_f32(vget_high_f32(vrev64q_f32(x)), vget_low_f32(vrev64q_f32(x)))
 typedef float32x4_t f4;
-static int have_simd()
+static int have_simd(void)
 {   /* TODO: detect neon for !MINIMP3_ONLY_SIMD */
     return 1;
 }
@@ -1654,6 +1654,21 @@ static void mp3d_synth_granule(float *qmf_state, float *grbuf, int nbands, int n
     }
 }
 
+static int hdr_is_tag(const uint8_t* hdr)
+{
+    return hdr[0] == 'T' && hdr[1] == 'A' && hdr[2] == 'G' && hdr[3] == '\0';
+}
+
+static int hdr_is_null(const uint8_t* hdr)
+{
+    return hdr[0] == '\0' && hdr[1] == '\0' && hdr[2] == '\0' && hdr[3] == '\0';
+}
+
+static int hdr_is_null_or_tag(const uint8_t* hdr)
+{
+    return hdr_is_tag(hdr) > 0 || hdr_is_null(hdr) > 0;
+}
+
 static int mp3d_match_frame(const uint8_t *hdr, int mp3_bytes, int frame_bytes)
 {
     int i, nmatch;
@@ -1662,6 +1677,8 @@ static int mp3d_match_frame(const uint8_t *hdr, int mp3_bytes, int frame_bytes)
         i += hdr_frame_bytes(hdr + i, frame_bytes) + hdr_padding(hdr + i);
         if (i + HDR_SIZE > mp3_bytes)
             return nmatch > 0;
+        if (hdr_is_null_or_tag(hdr + i))
+            return nmatch > 0;
         if (!hdr_compare(hdr, hdr + i))
             return 0;
     }

Plugins/minimp3/ThirdParty/minimp3.h

@@ -176,7 +176,7 @@ end:
 #define VMUL_S(x, s)  vmulq_f32(x, vmovq_n_f32(s))
 #define VREV(x) vcombine_f32(vget_high_f32(vrev64q_f32(x)), vget_low_f32(vrev64q_f32(x)))
 typedef float32x4_t f4;
-static int have_simd()
+static int have_simd(void)
 {   /* TODO: detect neon for !MINIMP3_ONLY_SIMD */
     return 1;
 }
@@ -1654,6 +1654,21 @@ static void mp3d_synth_granule(float *qmf_state, float *grbuf, int nbands, int n
     }
 }
 
+static int hdr_is_tag(const uint8_t* hdr)
+{
+    return hdr[0] == 'T' && hdr[1] == 'A' && hdr[2] == 'G' && hdr[3] == '\0';
+}
+
+static int hdr_is_null(const uint8_t* hdr)
+{
+    return hdr[0] == '\0' && hdr[1] == '\0' && hdr[2] == '\0' && hdr[3] == '\0';
+}
+
+static int hdr_is_null_or_tag(const uint8_t* hdr)
+{
+    return hdr_is_tag(hdr) > 0 || hdr_is_null(hdr) > 0;
+}
+
 static int mp3d_match_frame(const uint8_t *hdr, int mp3_bytes, int frame_bytes)
 {
     int i, nmatch;
@@ -1662,6 +1677,8 @@ static int mp3d_match_frame(const uint8_t *hdr, int mp3_bytes, int frame_bytes)
         i += hdr_frame_bytes(hdr + i, frame_bytes) + hdr_padding(hdr + i);
         if (i + HDR_SIZE > mp3_bytes)
             return nmatch > 0;
+        if (hdr_is_null_or_tag(hdr + i))
+            return nmatch > 0;
         if (!hdr_compare(hdr, hdr + i))
             return 0;
     }

Plugins/minimp3/ThirdParty/minimp3_ex.h

@@ -590,7 +590,7 @@ int mp3dec_iterate_cb(mp3dec_io_t *io, uint8_t *buf, size_t buf_size, MP3D_ITERA
         readed += i;
         if (callback)
         {
-            if ((ret = callback(user_data, hdr, frame_size, free_format_bytes, filled - consumed, readed, &frame_info)))
+            if ((ret = callback(user_data, hdr, frame_size, free_format_bytes, filled - consumed - i, readed, &frame_info)))
                 return ret;
         }
         readed += frame_size;