File libmikmod-CVE-2007-6720.patch of Package libmikmod

diff -up libmikmod-3.2.0b3/playercode/mplayer.c.CVE-2007-6720 libmikmod-3.2.0b3/playercode/mplayer.c
--- libmikmod-3.2.0b3/playercode/mplayer.c.CVE-2007-6720	2012-03-14 20:21:57.000000000 +0100
+++ libmikmod-3.2.0b3/playercode/mplayer.c	2012-04-10 06:32:28.046795898 +0200
@@ -50,6 +50,8 @@ extern long int random(void);
 /* The currently playing module */
 MODULE *pf = NULL;
 
+#define NUMVOICES(mod) (md_sngchn < (mod)->numvoices ? md_sngchn : (mod)->numvoices)
+
 #define	HIGH_OCTAVE		2	/* number of above-range octaves */
 
 static	UWORD oldperiods[OCTAVE*2]={
@@ -246,14 +248,14 @@ static int MP_FindEmptyChannel(MODULE *m
 	MP_VOICE *a;
 	ULONG t,k,tvol,pp;
 
-	for (t=0;t<md_sngchn;t++)
+	for (t=0;t<NUMVOICES(mod);t++)
 		if (((mod->voice[t].main.kick==KICK_ABSENT)||
 			 (mod->voice[t].main.kick==KICK_ENV))&&
 		   Voice_Stopped_internal(t))
 			return t;
 
 	tvol=0xffffffUL;t=-1;a=mod->voice;
-	for (k=0;k<md_sngchn;k++,a++) {
+	for (k=0;k<NUMVOICES(mod);k++,a++) {
 		/* allow us to take over a nonexisting sample */
 		if (!a->main.s)
 			return k;
@@ -2247,12 +2249,12 @@ static void DoNNAEffects(MODULE *mod, MP
 
 	switch (dat) {
 	case 0x0: /* past note cut */
-		for (t=0;t<md_sngchn;t++)
+		for (t=0;t<NUMVOICES(mod);t++)
 			if (mod->voice[t].master==a)
 				mod->voice[t].main.fadevol=0;
 		break;
 	case 0x1: /* past note off */
-		for (t=0;t<md_sngchn;t++)
+		for (t=0;t<NUMVOICES(mod);t++)
 			if (mod->voice[t].master==a) {
 				mod->voice[t].main.keyoff|=KEY_OFF;
 				if ((!(mod->voice[t].venv.flg & EF_ON))||
@@ -2261,7 +2263,7 @@ static void DoNNAEffects(MODULE *mod, MP
 			}
 		break;
 	case 0x2: /* past note fade */
-		for (t=0;t<md_sngchn;t++)
+		for (t=0;t<NUMVOICES(mod);t++)
 			if (mod->voice[t].master==a)
 				mod->voice[t].main.keyoff|=KEY_FADE;
 		break;
@@ -2316,7 +2318,7 @@ void pt_UpdateVoices(MODULE *mod, int ma
 	SAMPLE *s;
 
 	mod->totalchn=mod->realchn=0;
-	for (channel=0;channel<pf->numchn;channel++) {
+	for (channel=0;channel<NUMVOICES(mod);channel++) {
 		aout=&mod->voice[channel];
 		i=aout->main.i;
 		s=aout->main.s;
@@ -2737,7 +2739,7 @@ void pt_NNA(MODULE *mod)
 			if (a->dct!=DCT_OFF) {
 				int t;
 
-				for (t=0;t<md_sngchn;t++)
+				for (t=0;t<NUMVOICES(mod);t++)
 					if ((!Voice_Stopped_internal(t))&&
 					   (mod->voice[t].masterchn==channel)&&
 					   (a->main.sample==mod->voice[t].main.sample)) {
@@ -2979,6 +2981,11 @@ BOOL Player_Init(MODULE* mod)
 	if (!(mod->voice=(MP_VOICE*)MikMod_calloc(md_sngchn,sizeof(MP_VOICE))))
 		return 1;
 
+	/* mod->numvoices was used during loading to clamp md_sngchn.
+	   After loading it's used to remember how big mod->voice is.
+	*/
+	mod->numvoices = md_sngchn;
+
 	Player_Init_internal(mod);
 	return 0;
 }
@@ -3087,7 +3094,7 @@ MIKMODAPI void Player_NextPosition(void)
 		pf->patbrk=0;
 		pf->vbtick=pf->sngspd;
 
-		for (t=0;t<pf->numchn;t++) {
+		for (t=0;t<NUMVOICES(pf);t++) {
 			Voice_Stop_internal(t);
 			pf->voice[t].main.i=NULL;
 			pf->voice[t].main.s=NULL;
@@ -3112,7 +3119,7 @@ MIKMODAPI void Player_PrevPosition(void)
 		pf->patbrk=0;
 		pf->vbtick=pf->sngspd;
 
-		for (t=0;t<pf->numchn;t++) {
+		for (t=0;t<NUMVOICES(pf);t++) {
 			Voice_Stop_internal(t);
 			pf->voice[t].main.i=NULL;
 			pf->voice[t].main.s=NULL;
@@ -3139,7 +3146,7 @@ MIKMODAPI void Player_SetPosition(UWORD
 		pf->sngpos=pos;
 		pf->vbtick=pf->sngspd;
 
-		for (t=0;t<pf->numchn;t++) {
+		for (t=0;t<NUMVOICES(pf);t++) {
 			Voice_Stop_internal(t);
 			pf->voice[t].main.i=NULL;
 			pf->voice[t].main.s=NULL;