mp4: fix integer underflow

Reported-by: Hyeon-Ju Lee <zorurione@gmail.com>
(cherry picked from commit 8e8e0d72447f8378244f5b4a3dcde036dbeb1491)

Gbp-Pq: Name 0004-mp4-fix-integer-underflow.patch

diff --git a/modules/demux/mp4/mp4.c b/modules/demux/mp4/mp4.c
index 0c7aa2dd5006f05e0cffa49831e747344e551c75..9a702726788606f34b2729677cb39616c6661d07 100644 (file)
--- a/modules/demux/mp4/mp4.c
+++ b/modules/demux/mp4/mp4.c
@@ -447,10 +447,10 @@ static block_t * MP4_EIA608_Convert( block_t * p_block )
     } while( i_bytes >= 2 );
 
     /* cdt2 is optional */
-    if ( i_remaining >= 10 &&
-         (i_bytes = GetDWBE(p_read)) &&
-         (i_bytes <= i_remaining) &&
-         !memcmp("cdt2", &p_read[4], 4) )
+    i_bytes = GetDWBE(p_read);
+
+    if (10 <= i_bytes && i_bytes <= i_remaining &&
+        !memcmp("cdt2", &p_read[4], 4))
     {
         p_read += 8;
         i_bytes -= 8;