Add input checks to MIDI 1 -> 2 conversion routines

atsushieno · Oct 28, 2024 · c8c014c · c8c014c
1 parent 4483594
commit c8c014c
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/cmidi2.h b/cmidi2.h
@@ -2137,6 +2137,7 @@ enum cmidi2_midi_conversion_result {
     CMIDI2_CONVERSION_RESULT_INVALID_DTE_SEQUENCE = 0x11,
     CMIDI2_CONVERSION_RESULT_INVALID_STATUS = 0x13,
     CMIDI2_CONVERSION_RESULT_INCOMPLETE_SYSEX7 = 0x20,
+    CMIDI2_CONVERSION_RESULT_INVALID_INPUT = 0x40,
 };
 
 static inline void cmidi2_midi_conversion_context_initialize(cmidi2_midi_conversion_context* context) {
@@ -2245,7 +2246,11 @@ static enum cmidi2_midi_conversion_result cmidi2_convert_midi1_to_ump(cmidi2_mid
             *sIdx += sysexSize + 1; // +1 for 0xF7
         } else {
             // fixed sized message
-            size_t len = cmidi2_midi1_get_message_size(context->midi1 + *sIdx, sLen - *sIdx);
+            size_t remaining = sLen - *sIdx;
+            size_t len = cmidi2_midi1_get_message_size(context->midi1 + *sIdx, remaining);
+            if (len > remaining)
+                return CMIDI2_CONVERSION_RESULT_INVALID_INPUT;
+
             uint8_t byte2 = context->midi1[*sIdx + 1];
             uint8_t byte3 = len > 2 ? context->midi1[*sIdx + 2] : 0;
             uint8_t channel = context->midi1[*sIdx] & 0xF;