diff options
| author | Petri Hintukainen <phintuka@users.sourceforge.net> | 2011-10-04 11:14:55 +0300 |
|---|---|---|
| committer | Petri Hintukainen <phintuka@users.sourceforge.net> | 2011-10-04 11:14:55 +0300 |
| commit | 06a273f4917e5b7460985a33a96276b0f84dc8b1 (patch) | |
| tree | 6a6d0b3846b02fc50d2f53ac48534fa43785b6e1 | |
| parent | 44e75aa7b7f9a4f69a91e75691557a2b809949eb (diff) | |
| download | xine-lib-06a273f4917e5b7460985a33a96276b0f84dc8b1.tar.gz xine-lib-06a273f4917e5b7460985a33a96276b0f84dc8b1.tar.bz2 | |
demux_real: fixed buffer size check
Check used (NULL) target pointer instead of length and would be always false
| -rw-r--r-- | src/demuxers/demux_real.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/demuxers/demux_real.c b/src/demuxers/demux_real.c index 340083221..19b7794ef 100644 --- a/src/demuxers/demux_real.c +++ b/src/demuxers/demux_real.c @@ -303,7 +303,7 @@ static mdpr_t *real_parse_mdpr(const char *data, const unsigned int size) mdpr->mime_type[(int)mdpr->mime_type_size]=0; mdpr->type_specific_len=_X_BE_32(&data[34+mdpr->stream_name_size+mdpr->mime_type_size]); - if (size < 38 + mdpr->stream_name_size + mdpr->mime_type_size + mdpr->type_specific_data) + if (size < 38 + mdpr->stream_name_size + mdpr->mime_type_size + mdpr->type_specific_len) goto fail; mdpr->type_specific_data=malloc(mdpr->type_specific_len); if (!mdpr->type_specific_data) |