diff options
| author | Sebastian Dröge <sebastian@centricular.com> | 2023-06-13 14:25:04 +0300 |
|---|---|---|
| committer | GStreamer Marge Bot <gitlab-merge-bot@gstreamer-foundation.org> | 2023-06-21 00:14:38 +0000 |
| commit | b9a357db5ad779debeb22d5d294f79e1c9d11064 (patch) | |
| tree | 8f62bba3a41dd7add64c0660c9b180c22e246051 | |
| parent | ef83d981d10a44bd09eed0ad7faa6644fd704418 (diff) | |
dvdspu: Avoid integer overflow when checking if enough data is available
Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/4902>
| -rw-r--r-- | subprojects/gst-plugins-bad/gst/dvdspu/gstspu-pgs.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/subprojects/gst-plugins-bad/gst/dvdspu/gstspu-pgs.c b/subprojects/gst-plugins-bad/gst/dvdspu/gstspu-pgs.c index 391bb630f5..df0b8e2cbe 100644 --- a/subprojects/gst-plugins-bad/gst/dvdspu/gstspu-pgs.c +++ b/subprojects/gst-plugins-bad/gst/dvdspu/gstspu-pgs.c @@ -607,7 +607,8 @@ parse_set_object_data (GstDVDSpu * dvdspu, guint8 type, guint8 * payload, PGS_DUMP ("%d bytes of additional RLE data\n", (int) (end - payload)); /* Check that the data chunk is for this object version, and fits in the buffer */ if (obj->rle_data_ver == obj_ver && - obj->rle_data_used + end - payload <= obj->rle_data_size) { + end - payload <= obj->rle_data_size && + obj->rle_data_used <= obj->rle_data_size - (end - payload)) { memcpy (obj->rle_data + obj->rle_data_used, payload, end - payload); obj->rle_data_used += end - payload; |