Skip to content

V
vlc
Commit eb9963eb authored by Rémi Denis-Courmont's avatar Rémi Denis-Courmont
Browse files
Options

Real: fix integer overflow 

This is trivially exploitable to run code.

Pointed-out-by: Tobias Klein
parent 56acdf5c
Show whitespace changes
Inline Side-by-side
Showing with 1 addition and 4 deletions
modules/demux/real.c
View file @ eb9963eb
...@@ -928,13 +928,10 @@ static void ReadRealIndex( demux_t *p_demux ) ...@@ -928,13 +928,10 @@ static void ReadRealIndex( demux_t *p_demux )
msg_Dbg( p_demux, "Real Index: Does next index exist? %d ", msg_Dbg( p_demux, "Real Index: Does next index exist? %d ",
GetDWBE( &buffer[16] ) ); GetDWBE( &buffer[16] ) );
p_sys->p_index = p_sys->p_index = calloc( i_index_count + 1, sizeof( rm_index_t ) );
(rm_index_t *)malloc( sizeof( rm_index_t ) * (i_index_count+1) );
if( p_sys->p_index == NULL ) if( p_sys->p_index == NULL )
return; return;
memset( p_sys->p_index, 0, sizeof(rm_index_t) * (i_index_count+1) );
for( i=0; i<i_index_count; i++ ) for( i=0; i<i_index_count; i++ )
{ {
if( stream_Read( p_demux->s, buffer, 14 ) < 14 ) if( stream_Read( p_demux->s, buffer, 14 ) < 14 )
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment