summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorwm4 <wm4@nowhere>2014-07-02 00:14:18 +0200
committerAlessandro Ghedini <alessandro@ghedini.me>2014-07-05 00:25:38 +0200
commit0e35c230f426c14412c4af14838943b26fc898e8 (patch)
tree1ff756cea33963a702148225e5159010a384b80d
parent9ae80929ea58b5b93f276672a20cde66b8ca2366 (diff)
downloadmpv-0e35c230f426c14412c4af14838943b26fc898e8.tar.bz2
mpv-0e35c230f426c14412c4af14838943b26fc898e8.tar.xz
demux_mkv: minor improvement to overflow check
CC: @mpv-player/stable
-rw-r--r--demux/demux_mkv.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/demux/demux_mkv.c b/demux/demux_mkv.c
index ee355f258f..5ebfab4205 100644
--- a/demux/demux_mkv.c
+++ b/demux/demux_mkv.c
@@ -272,7 +272,8 @@ static bstr demux_mkv_decode(struct mp_log *log, mkv_track_t *track,
} else if (enc->comp_algo == 2) {
/* lzo encoded track */
int out_avail;
- if (size > INT_MAX / 3 + AV_LZO_OUTPUT_PADDING)
+ int maxlen = INT_MAX - AV_LZO_OUTPUT_PADDING;
+ if (size >= maxlen / 3)
goto error;
int dstlen = size * 3;
@@ -292,7 +293,7 @@ static bstr demux_mkv_decode(struct mp_log *log, mkv_track_t *track,
goto error;
}
mp_dbg(log, "lzo decompression buffer too small.\n");
- if (dstlen > INT_MAX / 2 + AV_LZO_OUTPUT_PADDING) {
+ if (dstlen >= maxlen / 2) {
talloc_free(dest);
dest = NULL;
goto error;