XSPF: fix realloc() integer overflow

(cherry picked from commit cd929923ff49175a501bb3e9553a683bc42ff61c)

XSPF: fix realloc() integer overflow
(cherry picked from commit cd929923ff49175a501bb3e9553a683bc42ff61c)
74d34b63 · Rémi Denis-Courmont · 50d38b6d · 74d34b63
Commit 74d34b63 authored Jun 04, 2011 by Rémi Denis-Courmont
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 1 deletion

modules/demux/playlist/xspf.c modules/demux/playlist/xspf.c +2 -1

No files found.
--- a/modules/demux/playlist/xspf.c
+++ b/modules/demux/playlist/xspf.c
@@ -504,7 +504,8 @@ static bool parse_track_node COMPLEX_INTERFACE
                    }
                    free( psz_uri );
-                    if( p_sys->i_track_id < 0 )
+                    if( p_sys->i_track_id < 0
+                     || p_sys->i_track_id >= (SIZE_MAX / sizeof(p_new_input)) )
                    {
                        input_item_node_AppendNode( p_input_node, p_new_node );
                        vlc_gc_decref( p_new_input );