[MPlayer-cvslog] r37646 - trunk/libmpdemux/demux_mov.c

[reimar]

Author: reimar
Date: Tue Feb  9 23:03:11 2016
New Revision: 37646

Log:
demux_mov: Fix checks to avoid overflows.

Modified:
   trunk/libmpdemux/demux_mov.c

Modified: trunk/libmpdemux/demux_mov.c
==============================================================================
--- trunk/libmpdemux/demux_mov.c	Tue Feb  9 22:52:11 2016	(r37645)
+++ trunk/libmpdemux/demux_mov.c	Tue Feb  9 23:03:11 2016	(r37646)
@@ -766,14 +766,14 @@ static int gen_sh_audio(sh_audio_t* sh,
 			  }
 		          break;
 		         default:
-			  if (len > 8 && len + 44 <= trak->stdata_len) {
+			  if (len > 8 && len <= trak->stdata_len - 44) {
 				sh->codecdata_len = len-8;
 				sh->codecdata = malloc(sh->codecdata_len);
 				memcpy(sh->codecdata, trak->stdata+44+8, sh->codecdata_len);
 			  }
 		        }
 		    } else {
-		      if (len > 8 && len + 44 <= trak->stdata_len) {
+		      if (len > 8 && len <= trak->stdata_len - 44) {
 		    sh->codecdata_len = len-8;
 		    sh->codecdata = malloc(sh->codecdata_len);
 		    memcpy(sh->codecdata, trak->stdata+44+8, sh->codecdata_len);