diff options
| author | Darren Salt <linux@youmustbejoking.demon.co.uk> | 2009-03-08 16:54:39 +0000 |
|---|---|---|
| committer | Darren Salt <linux@youmustbejoking.demon.co.uk> | 2009-03-08 16:54:39 +0000 |
| commit | 7e63be8ffb88c1fe981c7cf39c535a5553e35b31 (patch) | |
| tree | 6f5892c85acfa4b853956a05b5ee0fd47eae94e2 /src | |
| parent | e7377d3869eb77ea29c4b6ed5722b4a4b59cf5d7 (diff) | |
| download | xine-lib-7e63be8ffb88c1fe981c7cf39c535a5553e35b31.tar.gz xine-lib-7e63be8ffb88c1fe981c7cf39c535a5553e35b31.tar.bz2 | |
Fix another possible 4xm demuxer integer overflow.
--HG--
extra : transplant_source : U%AF%FD%B5%60%27Y%7F%B5Q%F796%F7a%98%F0k%B8%EF
Diffstat (limited to 'src')
| -rw-r--r-- | src/demuxers/demux_4xm.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/demuxers/demux_4xm.c b/src/demuxers/demux_4xm.c index 015ed8b2f..397a271b8 100644 --- a/src/demuxers/demux_4xm.c +++ b/src/demuxers/demux_4xm.c @@ -190,9 +190,9 @@ static int open_fourxm_file(demux_fourxm_t *fourxm) { return 0; } const uint32_t current_track = _X_LE_32(&header[i + 8]); - if (current_track + 1 > fourxm->track_count) { + if (current_track >= fourxm->track_count) { fourxm->track_count = current_track + 1; - if (fourxm->track_count >= UINT_MAX / sizeof(audio_track_t)) { + if (!fourxm->track_count || fourxm->track_count >= UINT_MAX / sizeof(audio_track_t)) { free(header); return 0; } |