Buffer 'gPi->TrackInfo' accessed by index 'sdTr' can overflow

Change-Id: I24dc045f8439c5ea64caadd327d3ba67f7a7d057

diff --git a/formats/ffmpeg/mm_file_format_midi.c b/formats/ffmpeg/mm_file_format_midi.c
index 6021ce7..74a91a0 100755 (executable)
--- a/formats/ffmpeg/mm_file_format_midi.c
+++ b/formats/ffmpeg/mm_file_format_midi.c
@@ -415,6 +415,12 @@ static long __AvGetSizeOfFileInfo(void)
                        if (!__AvMidGetLeastTimeTrack(&sdTr))
                                break;
                }
+
+               if (sdTr >= MAX_SMF_TRACKS) {
+                       debug_error(DEBUG, "__AvGetSizeOfFileInfo:  Num of tracks is over MAX track number. !!\n");
+                       return -1;
+               }
+
                pMt = &(gPi->TrackInfo[sdTr]);
 
                dTime = pMt->sdTicks - sdTotalTicks;
@@ -631,10 +637,6 @@ static long __AvGetSizeOfFileInfo(void)
                        }
                }
 
-               if (sdTr >= MAX_SMF_TRACKS) {
-                       debug_error(DEBUG, "__AvGetSizeOfFileInfo:  Num of tracks is over MAX track number. !!\n");
-                       return -1;
-               }
                __AvMidUpdateTrackTime(sdTr);
 
                if (dSetup == 0x0F) {