From a3d5c748f8d6a3d1e8f723dcbd32640eb1caf729 Mon Sep 17 00:00:00 2001
From: Aleksei Voitylov <avoitylov@openjdk.org>
Date: Wed, 25 May 2022 09:18:54 +0000
Subject: [PATCH] 8283190: Improve MIDI processing

Reviewed-by: yan
Backport-of: e0329eb343661edd5066deb6ae5d99a742135831
---
 .../com/sun/media/sound/StandardMidiFileReader.java      | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/src/java.desktop/share/classes/com/sun/media/sound/StandardMidiFileReader.java b/src/java.desktop/share/classes/com/sun/media/sound/StandardMidiFileReader.java
index 6f5a4bbf3c9..85f31acb0d5 100644
--- a/src/java.desktop/share/classes/com/sun/media/sound/StandardMidiFileReader.java
+++ b/src/java.desktop/share/classes/com/sun/media/sound/StandardMidiFileReader.java
@@ -380,6 +380,11 @@ final class SMFParser {
                     case 0xF7:
                         // sys ex
                         int sysexLength = (int) readVarInt();
+                        if (sysexLength < 0 || sysexLength > trackLength - pos) {
+                            throw new InvalidMidiDataException("Message length is out of bounds: "
+                                    + sysexLength);
+                        }
+
                         byte[] sysexData = new byte[sysexLength];
                         read(sysexData);
 
@@ -392,8 +397,8 @@ final class SMFParser {
                         // meta
                         int metaType = readUnsigned();
                         int metaLength = (int) readVarInt();
-                        if (metaLength < 0) {
-                            throw new InvalidMidiDataException("length out of bounds: "
+                        if (metaLength < 0 || metaLength > trackLength - pos) {
+                            throw new InvalidMidiDataException("Message length is out of bounds: "
                                     + metaLength);
                         }
                         final byte[] metaData;