Commit 96dac2d9 authored by Laurent Aimar's avatar Laurent Aimar

Fixed undefined behavior with integer overflow.

Pointed out by Courmish.
parent fd453018
...@@ -28,6 +28,7 @@ ...@@ -28,6 +28,7 @@
#include <vlc_common.h> #include <vlc_common.h>
#include <vlc_playlist.h> #include <vlc_playlist.h>
#include <vlc_stream.h> #include <vlc_stream.h>
#include <limits.h>
#include "art.h" #include "art.h"
#include "fetcher.h" #include "fetcher.h"
...@@ -269,7 +270,7 @@ static int DownloadArt( playlist_t *p_playlist, input_item_t *p_item ) ...@@ -269,7 +270,7 @@ static int DownloadArt( playlist_t *p_playlist, input_item_t *p_item )
{ {
int i_read = 65536; int i_read = 65536;
if( i_data + i_read <= i_data ) /* Protect gainst overflow */ if( i_data >= INT_MAX - i_read )
break; break;
p_data = realloc( p_data, i_data + i_read ); p_data = realloc( p_data, i_data + i_read );
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment