1 files changed, 14 insertions, 4 deletions

diff --git a/src/demuxers/demux_mng.c b/src/demuxers/demux_mng.c
index 12da8ca86..d0d83ff80 100644
--- a/src/demuxers/demux_mng.c
+++ b/src/demuxers/demux_mng.c
@@ -104,7 +104,12 @@ static mng_bool mymng_close_stream(mng_handle mngh){
 static mng_bool mymng_read_stream(mng_handle mngh, mng_ptr buffer, mng_uint32 size, mng_uint32 *bytesread){
   demux_mng_t *this = (demux_mng_t*)mng_get_userdata(mngh);
 
-  *bytesread = this->input->read(this->input, buffer, size);
+  off_t n = this->input->read(this->input, buffer, size);
+  if (n < 0) {
+	*bytesread = 0;
+	return MNG_FALSE;
+  }
+  *bytesread = n;
 
   return MNG_TRUE;
 }
@@ -112,11 +117,16 @@ static mng_bool mymng_read_stream(mng_handle mngh, mng_ptr buffer, mng_uint32 si
 static mng_bool mymng_process_header(mng_handle mngh, mng_uint32 width, mng_uint32 height){
   demux_mng_t *this = (demux_mng_t*)mng_get_userdata(mngh);
 
+  if (width > 0x8000 || height > 0x8000)
+      return MNG_FALSE;
+
   this->bih.biWidth = (width + 7) & ~7;
   this->bih.biHeight = height;
   this->left_edge = (this->bih.biWidth - width) / 2;
 
-  this->image = malloc(this->bih.biWidth * height * 3);
+  this->image = malloc((mng_size_t)this->bih.biWidth * (mng_size_t)height * 3);
+  if (!this->image)
+    return MNG_FALSE;
 
   mng_set_canvasstyle(mngh, MNG_CANVAS_RGB8);
 
@@ -260,7 +270,7 @@ static demux_plugin_t* open_plugin(demux_class_t *class_gen, xine_stream_t *stre
 
   demux_mng_t    *this;
 
-  this         = xine_xmalloc (sizeof (demux_mng_t));
+  this         = calloc(1, sizeof(demux_mng_t));
   this->stream = stream;
   this->input  = input;
 
@@ -360,7 +370,7 @@ static void class_dispose(demux_class_t *this){
 static void *init_plugin(xine_t *xine, void *data){
   demux_mng_class_t     *this;
 
-  this  = xine_xmalloc (sizeof (demux_mng_class_t));
+  this  = calloc(1, sizeof(demux_mng_class_t));
 
   this->demux_class.open_plugin     = open_plugin;
   this->demux_class.get_description = get_description;