From cb82d7b686affd1d90e72b88acddf8d8d99ed972 Mon Sep 17 00:00:00 2001 From: Darren Salt Date: Thu, 25 Feb 2010 00:02:29 +0000 Subject: Fix a size check (wrong variable, causing int/ptr comparison) in rmff.c. --- ChangeLog | 1 + src/input/libreal/rmff.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 1e92e2a7b..0ef413aac 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,6 +1,7 @@ xine-lib (1.1.18.1) 2010-??-?? * Oops. compat.c (for DXR3 support) was omitted. * Fix up V4L/V4L2 compilation. Some non-Linux have V4L2 but not V4L. + * Fix a size check (wrong variable, causing int/ptr comparison) in rmff.c. xine-lib (1.1.18) 2010-02-23 * Bump the FLAC decoder's priority above ffmpegaudio. This should fix diff --git a/src/input/libreal/rmff.c b/src/input/libreal/rmff.c index 6a2b761e1..82554a350 100644 --- a/src/input/libreal/rmff.c +++ b/src/input/libreal/rmff.c @@ -375,7 +375,7 @@ static rmff_mdpr_t *rmff_scan_mdpr(const char *data) mdpr->mime_type[mdpr->mime_type_size]=0; mdpr->type_specific_len=_X_BE_32(&data[42+mdpr->stream_name_size+mdpr->mime_type_size]); - if (mdpr->size < 46 + mdpr->stream_name_size + mdpr->mime_type_size + mdpr->type_specific_data) + if (mdpr->size < 46 + mdpr->stream_name_size + mdpr->mime_type_size + mdpr->type_specific_len) goto fail; mdpr->type_specific_data = malloc(mdpr->type_specific_len); if (!mdpr->type_specific_data) -- cgit v1.2.3