Commit 964c85aa authored by Laurent Aimar's avatar Laurent Aimar Committed by Jean-Baptiste Kempf

Fixed a potential integer overflow in MemToBlock().

When the integer overflow happens, the block_t returned will be smaller
than requested.
It fixes the second half of #5841.
(cherry picked from commit 04c9c0e7)
Signed-off-by: default avatarJean-Baptiste Kempf <jb@videolan.org>
parent 81a54d65
...@@ -455,6 +455,9 @@ static void Seek( demux_t *p_demux, mtime_t i_date, double f_percent, virtual_ch ...@@ -455,6 +455,9 @@ static void Seek( demux_t *p_demux, mtime_t i_date, double f_percent, virtual_ch
/* Utility function for BlockDecode */ /* Utility function for BlockDecode */
static block_t *MemToBlock( uint8_t *p_mem, size_t i_mem, size_t offset) static block_t *MemToBlock( uint8_t *p_mem, size_t i_mem, size_t offset)
{ {
if( unlikely( i_mem > SIZE_MAX - offset ) )
return NULL;
block_t *p_block = block_New( p_demux, i_mem + offset ); block_t *p_block = block_New( p_demux, i_mem + offset );
if( likely(p_block != NULL) ) if( likely(p_block != NULL) )
{ {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment