# HG changeset patch
# User nicodvb
# Date 1115942454 0
# Node ID 79008c38fcd971ebd2f0d7941ed031f63b63374d
# Parent  2071633f9bdc611a4c25d383da2ba485bf4ec707
prevent possible exploit

diff -r 2071633f9bdc -r 79008c38fcd9 libmpdemux/demux_ogg.c
--- a/libmpdemux/demux_ogg.c	Thu May 12 23:32:26 2005 +0000
+++ b/libmpdemux/demux_ogg.c	Fri May 13 00:00:54 2005 +0000
@@ -758,6 +758,7 @@
   ogg_packet op[3];
   unsigned char *buf[3];
   unsigned char *ptr;
+  unsigned int len;
 
   for(i = 0; i < 3; i++) {
     op[i].bytes = ds_get_packet(sh->ds, &(op[i].packet));
@@ -772,7 +773,8 @@
     memcpy(buf[i], op[i].packet, op[i].bytes);
   }
 
-  sh->wf = (WAVEFORMATEX*)calloc(1, sizeof(WAVEFORMATEX) + op[0].bytes + op[1].bytes + op[2].bytes + 64);
+  len = op[0].bytes + op[1].bytes + op[2].bytes;
+  sh->wf = (WAVEFORMATEX*)calloc(1, sizeof(WAVEFORMATEX) + len + len/255 + 64);
   ptr = (unsigned char*) (sh->wf+1);
 
   ptr[0] = 2;