jdk/src/java.desktop/share/classes/com/sun/media/sound/SF2Soundbank.java
changeset 26037 508779ce6619
parent 26022 45e78fc2279f
parent 25859 3317bb8137f4
child 40444 afabcfc2f3ef
--- a/jdk/src/java.desktop/share/classes/com/sun/media/sound/SF2Soundbank.java	Mon Aug 18 14:03:21 2014 +0100
+++ b/jdk/src/java.desktop/share/classes/com/sun/media/sound/SF2Soundbank.java	Tue Aug 19 10:32:16 2014 -0700
@@ -276,6 +276,9 @@
                     count--;
                 }
 
+                if (presets_bagNdx.isEmpty()) {
+                    throw new RIFFInvalidDataException();
+                }
                 int offset = presets_bagNdx.get(0);
                 // Offset should be 0 (but just case)
                 for (int i = 0; i < offset; i++) {
@@ -360,6 +363,9 @@
                     count--;
                 }
 
+                if (instruments_bagNdx.isEmpty()) {
+                    throw new RIFFInvalidDataException();
+                }
                 int offset = instruments_bagNdx.get(0);
                 // Offset should be 0 (but just case)
                 for (int i = 0; i < offset; i++) {
@@ -401,6 +407,9 @@
                     modulator.amount = chunk.readShort();
                     modulator.amountSourceOperator = chunk.readUnsignedShort();
                     modulator.transportOperator = chunk.readUnsignedShort();
+                    if (i < 0 || i >= instruments_splits_gen.size()) {
+                        throw new RIFFInvalidDataException();
+                    }
                     SF2LayerRegion split = instruments_splits_gen.get(i);
                     if (split != null)
                         split.modulators.add(modulator);
@@ -424,7 +433,8 @@
                     sample.name = chunk.readString(20);
                     long start = chunk.readUnsignedInt();
                     long end = chunk.readUnsignedInt();
-                    sample.data = sampleData.subbuffer(start * 2, end * 2, true);
+                    if (sampleData != null)
+                        sample.data = sampleData.subbuffer(start * 2, end * 2, true);
                     if (sampleData24 != null)
                         sample.data24 = sampleData24.subbuffer(start, end, true);
                     /*
@@ -462,6 +472,9 @@
                     int sampleid = split.generators.get(
                             SF2LayerRegion.GENERATOR_SAMPLEID);
                     split.generators.remove(SF2LayerRegion.GENERATOR_SAMPLEID);
+                    if (sampleid < 0 || sampleid >= samples.size()) {
+                        throw new RIFFInvalidDataException();
+                    }
                     split.sample = samples.get(sampleid);
                 } else {
                     globalsplit = split;
@@ -488,6 +501,9 @@
                     int instrumentid = split.generators.get(
                             SF2InstrumentRegion.GENERATOR_INSTRUMENT);
                     split.generators.remove(SF2LayerRegion.GENERATOR_INSTRUMENT);
+                    if (instrumentid < 0 || instrumentid >= layers.size()) {
+                        throw new RIFFInvalidDataException();
+                    }
                     split.layer = layers.get(instrumentid);
                 } else {
                     globalsplit = split;