Bug 520500 - Don't reject vorbis streams with 0 length comments. r=doublec

content/media/test/Makefile.in

@@ -134,6 +134,7 @@ _TEST_FILES += \
 		bug506094.ogv \
 		bug516323.ogv \
 		bug520493.ogg \
+		bug520500.ogg \
 		chain.ogv \
 		dirac.ogg \
 		seek.ogv \

content/media/test/manifest.js

@@ -47,7 +47,9 @@ var gPlayTests = [
   { name:"beta-phrasebook.ogg", type:"audio/ogg", duration:4 },
   // Small file, only 1 frame with audio only.
   { name:"bug520493.ogg", type:"audio/ogg", duration:0.458 },
- 
+  // Small file with vorbis comments with 0 length values and names.
+  { name:"bug520500.ogg", type:"audio/ogg", duration:0.123 },
+
   { name:"bogus.duh", type:"bogus/duh" }
 ];
 

media/libfishsound/README_MOZILLA

@@ -14,4 +14,5 @@ endian.patch is applied to fix Bug 45269.
 bug487519.patch: Fixes for bug487519
 trac497.patch: Annodex trac ticket 497 fix and mozilla bug 462141.
 fishsound_reset.patch: Fixes bug 516323.
-
+bug520500.patch: Don't reject files with vorbis comments with name or
+                 values of length 0.

media/libfishsound/bug520500.patch

@@ -0,0 +1,54 @@
+diff --git a/media/libfishsound/src/libfishsound/fishsound_comments.c b/media/libfishsound/src/libfishsound/fishsound_comments.c
+--- a/media/libfishsound/src/libfishsound/fishsound_comments.c
++++ b/media/libfishsound/src/libfishsound/fishsound_comments.c
+@@ -480,44 +480,47 @@ fish_sound_comments_decode (FishSound * 
+       len=readint(c, 0);
+       debug_printf (1, "[%d] len %d\n", i, len);
+ 
+       c+=4;
+       if (len > (unsigned long) (end-c)) return -1;
+ 
+       name = c;
+       value = fs_index_len (c, '=', len);
++      n = 0;
+       if (value) {
+ 	*value = '\0';
+ 	value++;
+-
+ 	n = c+len - value;
++	
++      }
++      if (n) {
+ 	if ((nvalue = fs_strdup_len (value, n)) == NULL)
+           return FISH_SOUND_ERR_OUT_OF_MEMORY;
+ 
+ 	debug_printf (1, "%s -> %s (length %d)", name, nvalue, n);
+ 
+ 	if ((comment = fs_comment_new (name, nvalue)) == NULL) {
+ 	  fs_free (nvalue);
+           return FISH_SOUND_ERR_OUT_OF_MEMORY;
+ 	}
+ 
+ 	if (_fs_comment_add (fsound, comment) == NULL) {
+ 	  fs_free (nvalue);
+           return FISH_SOUND_ERR_OUT_OF_MEMORY;
+ 	}
+ 
+ 	fs_free (nvalue);
+-      } else {
++      } else if (len > 0) {
+         debug_printf (1, "[%d] %s (no value)", i, name, len);
+ 
+ 	if ((nvalue = fs_strdup_len (name, len)) == NULL)
+           return FISH_SOUND_ERR_OUT_OF_MEMORY;
+ 
+-	if ((comment = fs_comment_new (nvalue, NULL)) == NULL) {
++	if ((comment = fs_comment_new (nvalue, "")) == NULL) {
+ 	  fs_free (nvalue);
+           return FISH_SOUND_ERR_OUT_OF_MEMORY;
+ 	}
+ 
+ 	if (_fs_comment_add (fsound, comment) == NULL) {
+ 	  fs_free (nvalue);
+           return FISH_SOUND_ERR_OUT_OF_MEMORY;
+ 	}

media/libfishsound/src/libfishsound/fishsound_comments.c

@@ -485,11 +485,14 @@ fish_sound_comments_decode (FishSound * fsound, unsigned char * comments,
 
       name = c;
       value = fs_index_len (c, '=', len);
+      n = 0;
       if (value) {
 	*value = '\0';
 	value++;
-
 	n = c+len - value;
+	
+      }
+      if (n) {
 	if ((nvalue = fs_strdup_len (value, n)) == NULL)
           return FISH_SOUND_ERR_OUT_OF_MEMORY;
 
@@ -506,13 +509,13 @@ fish_sound_comments_decode (FishSound * fsound, unsigned char * comments,
 	}
 
 	fs_free (nvalue);
-      } else {
+      } else if (len > 0) {
         debug_printf (1, "[%d] %s (no value)", i, name, len);
 
 	if ((nvalue = fs_strdup_len (name, len)) == NULL)
           return FISH_SOUND_ERR_OUT_OF_MEMORY;
 
-	if ((comment = fs_comment_new (nvalue, NULL)) == NULL) {
+	if ((comment = fs_comment_new (nvalue, "")) == NULL) {
 	  fs_free (nvalue);
           return FISH_SOUND_ERR_OUT_OF_MEMORY;
 	}

media/libfishsound/update.sh

@@ -43,4 +43,4 @@ patch -p3 <endian.patch
 patch -p3 <bug487519.patch
 patch -p3 <trac497.patch
 patch -p3 <fishsound_reset.patch
-
+patch -p3 <bug520500.patch