From b12da14c4e5be6ded553e097a19d255ab221f5cd Mon Sep 17 00:00:00 2001
From: Sergey Bylokhov <serb@openjdk.org>
Date: Wed, 26 Jan 2022 20:15:04 +0000
Subject: [PATCH] 8272255: Completely handle MIDI files

Reviewed-by: bae
Backport-of: 6efdd1870e7ddb77a04d8c8183ced385039d0913
---
 .../media/sound/AudioFileSoundbankReader.java | 25 ++++++++++++++-----
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/jdk/src/share/classes/com/sun/media/sound/AudioFileSoundbankReader.java b/jdk/src/share/classes/com/sun/media/sound/AudioFileSoundbankReader.java
index 11b0fa6ee6..841de2f9b0 100644
--- a/jdk/src/share/classes/com/sun/media/sound/AudioFileSoundbankReader.java
+++ b/jdk/src/share/classes/com/sun/media/sound/AudioFileSoundbankReader.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2007, 2013, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2007, 2021, Oracle and/or its affiliates. All rights reserved.
  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
  *
  * This code is free software; you can redistribute it and/or modify it
@@ -76,12 +76,26 @@ public final class AudioFileSoundbankReader extends SoundbankReader {
 
     public Soundbank getSoundbank(AudioInputStream ais)
             throws InvalidMidiDataException, IOException {
+        int MEGABYTE = 1048576;
+        int DEFAULT_BUFFER_SIZE = 65536;
+        int MAX_FRAME_SIZE = 1024;
         try {
             byte[] buffer;
-            if (ais.getFrameLength() == -1) {
+            int frameSize = ais.getFormat().getFrameSize();
+            if (frameSize <= 0 || frameSize > MAX_FRAME_SIZE) {
+                throw new InvalidMidiDataException("Formats with frame size "
+                        + frameSize + " are not supported");
+            }
+
+            long totalSize = ais.getFrameLength() * frameSize;
+            if (totalSize >= Integer.MAX_VALUE - 2) {
+                throw new InvalidMidiDataException(
+                        "Can not allocate enough memory to read audio data.");
+            }
+
+            if (ais.getFrameLength() == -1 || totalSize > MEGABYTE) {
                 ByteArrayOutputStream baos = new ByteArrayOutputStream();
-                byte[] buff = new byte[1024
-                        - (1024 % ais.getFormat().getFrameSize())];
+                byte[] buff = new byte[DEFAULT_BUFFER_SIZE - (DEFAULT_BUFFER_SIZE % frameSize)];
                 int ret;
                 while ((ret = ais.read(buff)) != -1) {
                     baos.write(buff, 0, ret);
@@ -89,8 +103,7 @@ public final class AudioFileSoundbankReader extends SoundbankReader {
                 ais.close();
                 buffer = baos.toByteArray();
             } else {
-                buffer = new byte[(int) (ais.getFrameLength()
-                                    * ais.getFormat().getFrameSize())];
+                buffer = new byte[(int) totalSize];
                 new DataInputStream(ais).readFully(buffer);
             }
             ModelByteBufferWavetable osc = new ModelByteBufferWavetable(