XSPF: fix realloc() integer overflow

cd929923 · Rémi Denis-Courmont · bba95f3f · cd929923
Commit cd929923 authored Jun 04, 2011 by Rémi Denis-Courmont
Hide whitespace changes
Inline Side-by-side

Showing with 2 additions and 1 deletion

modules/demux/playlist/xspf.c modules/demux/playlist/xspf.c +2 -1

No files found.
--- a/modules/demux/playlist/xspf.c
+++ b/modules/demux/playlist/xspf.c
@@ -427,7 +427,8 @@ static bool parse_track_node COMPLEX_INTERFACE
                    else
                        free( psz_uri );
-                    if( p_sys->i_track_id < 0 )
+                    if( p_sys->i_track_id < 0
+                     || p_sys->i_track_id >= (SIZE_MAX / sizeof(p_new_input)) )
                    {
                        input_item_node_AppendNode( p_input_node, p_new_node );
                        vlc_gc_decref( p_new_input );