From 6fc85e6c9d883184992ab12abd4a28645aad6f22 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Ren=C3=A9=20Stadler?= Date: Tue, 11 Oct 2011 22:10:27 +0200 Subject: [PATCH] matroskamux: fix possible crash with malformed dirac codec_data Since size is unsigned, we need to safeguard against wrapping below zero. --- gst/matroska/matroska-mux.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/gst/matroska/matroska-mux.c b/gst/matroska/matroska-mux.c index b0ff579..5204b39 100644 --- a/gst/matroska/matroska-mux.c +++ b/gst/matroska/matroska-mux.c @@ -2594,7 +2594,7 @@ gst_matroska_mux_handle_dirac_packet (GstMatroskaMux * mux, next_parse_offset = GST_READ_UINT32_BE (data + 5); - if (G_UNLIKELY (next_parse_offset == 0)) + if (G_UNLIKELY (next_parse_offset == 0 || next_parse_offset > size)) break; data += next_parse_offset; -- 2.7.4