Mercurial > libavformat.hg

changeset 5178:092a527cabc8 libavformat

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Extend check for integer overflow for malloc argument to take into account also the addition of "sound_buffers" not only the multiplication.
author reimar
date Mon, 14 Sep 2009 17:15:18 +0000
parents 951c95954c9c
children cd0985411145
files sierravmd.c
diffstat 1 files changed, 1 insertions(+), 1 deletions(-) [+]
line wrap: on
line diff
--- a/sierravmd.c	Mon Sep 14 17:05:13 2009 +0000
+++ b/sierravmd.c	Mon Sep 14 17:15:18 2009 +0000
@@ -154,7 +154,7 @@
     vmd->frame_table = NULL;
     sound_buffers = AV_RL16(&vmd->vmd_header[808]);
     raw_frame_table_size = vmd->frame_count * 6;
-    if(vmd->frame_count * vmd->frames_per_block  >= UINT_MAX / sizeof(vmd_frame)){
+    if(vmd->frame_count * vmd->frames_per_block  >= (UINT_MAX - sound_buffers) / sizeof(vmd_frame)){
         av_log(s, AV_LOG_ERROR, "vmd->frame_count * vmd->frames_per_block too large\n");
         return -1;
     }