From a0b9021d54dc9890da5f0c9bd26361db4556f6c2 Mon Sep 17 00:00:00 2001
From: Darren Salt <linux@youmustbejoking.demon.co.uk>
Date: Tue, 10 Feb 2009 17:17:50 +0000
Subject: Fix broken size checks in various input plugins (ref. CVE-2008-5239).

---
 src/input/input_mms.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'src/input/input_mms.c')

diff --git a/src/input/input_mms.c b/src/input/input_mms.c
index d5cc0a2ac..cd88a0609 100644
--- a/src/input/input_mms.c
+++ b/src/input/input_mms.c
@@ -122,7 +122,9 @@ static buf_element_t *mms_plugin_read_block (input_plugin_t *this_gen,
 
   lprintf ("mms_plugin_read_block: %"PRId64" bytes...\n", todo);
 
-  if (todo < 0 || todo > buf->size) {
+  if (todo > buf->max_size)
+    todo = buf->max_size;
+  if (todo < 0) {
     buf->free_buffer (buf);
     return NULL;
   }
-- 
cgit v1.2.3