Commit 04c9c0e7 authored by Laurent Aimar's avatar Laurent Aimar

Fixed a potential integer overflow in MemToBlock().

When the integer overflow happens, the block_t returned will be smaller
than requested.
It fixes the second half of #5841.
parent 64756cf2
......@@ -455,6 +455,9 @@ static void Seek( demux_t *p_demux, mtime_t i_date, double f_percent, virtual_ch
/* Utility function for BlockDecode */
static block_t *MemToBlock( uint8_t *p_mem, size_t i_mem, size_t offset)
{
if( unlikely( i_mem > SIZE_MAX - offset ) )
return NULL;
block_t *p_block = block_New( p_demux, i_mem + offset );
if( likely(p_block != NULL) )
{
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment