riff: prevent crash if rounded up tag size exceeds data size

When rounding up `tsize' exceeds the remaining buffer size, `size' underflows
and an invalid read past the buffer data follows.

diff --git a/gst-libs/gst/riff/riff-read.c b/gst-libs/gst/riff/riff-read.c
index fe0aa74..28f4a80 100644 (file)
--- a/gst-libs/gst/riff/riff-read.c
+++ b/gst-libs/gst/riff/riff-read.c
@@ -728,8 +728,11 @@ gst_riff_parse_info (GstElement * element,
       }
     }
 
-    if (tsize & 1)
+    if (tsize & 1) {
       tsize++;
+      if (tsize > size)
+        tsize = size;
+    }
 
     data += tsize;
     size -= tsize;