3 files changed, 16 insertions, 0 deletions
diff --git a/indra/llaudio/llvorbisencode.cpp b/indra/llaudio/llvorbisencode.cpp
index 9f479189d7..0e0c80a456 100644
--- a/indra/llaudio/llvorbisencode.cpp
+++ b/indra/llaudio/llvorbisencode.cpp
@@ -120,6 +120,13 @@ S32 check_for_invalid_wav_formats(const std::string& in_fname, std::string& erro
 			+ ((U32) wav_header[5] << 8) 
 			+ wav_header[4];
 
+		if (chunk_length > physical_file_size - file_pos - 4)
+		{
+			infile.close();
+			error_msg = "SoundFileInvalidChunkSize";
+			return(LLVORBISENC_CHUNK_SIZE_ERR);
+		}
+
 //		llinfos << "chunk found: '" << wav_header[0] << wav_header[1] << wav_header[2] << wav_header[3] << "'" << llendl;
 
 		if (!(strncmp((char *)&(wav_header[0]),"fmt ",4)))
diff --git a/indra/llaudio/llvorbisencode.h b/indra/llaudio/llvorbisencode.h
index d33aacf1ea..6b22a2cb59 100644
--- a/indra/llaudio/llvorbisencode.h
+++ b/indra/llaudio/llvorbisencode.h
@@ -38,6 +38,7 @@ const S32 LLVORBISENC_MULTICHANNEL_ERR             = 7; // can't do stereo
 const S32 LLVORBISENC_UNSUPPORTED_SAMPLE_RATE      = 8; // unsupported sample rate
 const S32 LLVORBISENC_UNSUPPORTED_WORD_SIZE        = 9; // unsupported word size
 const S32 LLVORBISENC_CLIP_TOO_LONG                = 10; // source file is too long
+const S32 LLVORBISENC_CHUNK_SIZE_ERR               = 11; // chunk size is wrong
 
 const F32 LLVORBIS_CLIP_MAX_TIME                               = 10.0f;
 const U8  LLVORBIS_CLIP_MAX_CHANNELS                   = 2;
diff --git a/indra/newview/skins/default/xui/en/notifications.xml b/indra/newview/skins/default/xui/en/notifications.xml
index 83cbcb3344..4ee04b44b6 100644
--- a/indra/newview/skins/default/xui/en/notifications.xml
+++ b/indra/newview/skins/default/xui/en/notifications.xml
@@ -1367,6 +1367,14 @@ Could not find &apos;data&apos; chunk in WAV header:
 
   <notification
    icon="alertmodal.tga"
+   name="SoundFileInvalidChunkSize"
+   type="alertmodal">
+Wrong chunk size in WAV file:
+[FILE]
+  </notification>
+
+  <notification
+   icon="alertmodal.tga"
    name="SoundFileInvalidTooLong"
    type="alertmodal">
 Audio file is too long (10 second maximum):