From 88d036f3ce1092cfd25960d8206b16c362ee0208 Mon Sep 17 00:00:00 2001 From: =?utf8?q?R=C3=A9mi=20Denis-Courmont?= Date: Thu, 27 Jun 2019 23:19:38 +0300 Subject: [PATCH] mp4: fix integer underflow Reported-by: Hyeon-Ju Lee (cherry picked from commit b2b157076d9e94df34502dd8df0787deb940e938) Gbp-Pq: Name 0003-mp4-fix-integer-underflow.patch --- modules/demux/mp4/mp4.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/modules/demux/mp4/mp4.c b/modules/demux/mp4/mp4.c index edda423b..0c7aa2dd 100644 --- a/modules/demux/mp4/mp4.c +++ b/modules/demux/mp4/mp4.c @@ -421,11 +421,11 @@ static block_t * MP4_EIA608_Convert( block_t * p_block ) block_t *p_newblock; /* always need at least 10 bytes (atom size+header+1pair)*/ - if ( i_remaining < 10 || - !(i_bytes = GetDWBE(p_block->p_buffer)) || - (i_bytes > i_remaining) || - memcmp("cdat", &p_block->p_buffer[4], 4) || - !(p_newblock = block_Alloc( i_remaining * 3 - 8 )) ) + i_bytes = GetDWBE(p_block->p_buffer); + + if (10 < i_bytes || i_bytes < i_remaining || + memcmp("cdat", &p_block->p_buffer[4], 4) || + (p_newblock = block_Alloc(i_remaining * 3 - 8)) == NULL) { p_block->i_buffer = 0; return p_block; -- 2.30.2