diff options
author | wm4 <wm4@nowhere> | 2014-07-02 00:14:18 +0200 |
---|---|---|
committer | wm4 <wm4@nowhere> | 2014-07-02 00:14:18 +0200 |
commit | bb131f4c669c0fcfac325e2d0a6676c95bb425c7 (patch) | |
tree | 58679b76a09eafe7a6cce99a3db99b790d3b6b10 /demux/demux_mkv.c | |
parent | 9a210ca2d50e02bf045866bbb2f44a33a3c48cd9 (diff) | |
download | mpv-bb131f4c669c0fcfac325e2d0a6676c95bb425c7.tar.bz2 mpv-bb131f4c669c0fcfac325e2d0a6676c95bb425c7.tar.xz |
demux_mkv: minor improvement to overflow check
CC: @mpv-player/stable
Diffstat (limited to 'demux/demux_mkv.c')
-rw-r--r-- | demux/demux_mkv.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/demux/demux_mkv.c b/demux/demux_mkv.c index 25591cd60a..470a9b9847 100644 --- a/demux/demux_mkv.c +++ b/demux/demux_mkv.c @@ -271,7 +271,8 @@ static bstr demux_mkv_decode(struct mp_log *log, mkv_track_t *track, } else if (enc->comp_algo == 2) { /* lzo encoded track */ int out_avail; - if (size > INT_MAX / 3 + AV_LZO_OUTPUT_PADDING) + int maxlen = INT_MAX - AV_LZO_OUTPUT_PADDING; + if (size >= maxlen / 3) goto error; int dstlen = size * 3; @@ -291,7 +292,7 @@ static bstr demux_mkv_decode(struct mp_log *log, mkv_track_t *track, goto error; } mp_dbg(log, "lzo decompression buffer too small.\n"); - if (dstlen > INT_MAX / 2 + AV_LZO_OUTPUT_PADDING) { + if (dstlen >= maxlen / 2) { talloc_free(dest); dest = NULL; goto error; |