23 lines
921 B
Diff
23 lines
921 B
Diff
Index: xine-lib-1.1.16.1/src/demuxers/demux_4xm.c
|
|
===================================================================
|
|
--- xine-lib-1.1.16.1.orig/src/demuxers/demux_4xm.c
|
|
+++ xine-lib-1.1.16.1/src/demuxers/demux_4xm.c
|
|
@@ -190,8 +190,16 @@ static int open_fourxm_file(demux_fourxm
|
|
return 0;
|
|
}
|
|
const uint32_t current_track = _X_LE_32(&header[i + 8]);
|
|
- if (current_track + 1 > fourxm->track_count) {
|
|
+ if(current_track >= UINT_MAX / sizeof(audio_track_t) - 1){
|
|
+ free(header);
|
|
+ return 0;
|
|
+ }
|
|
+ if (current_track >= fourxm->track_count) {
|
|
fourxm->track_count = current_track + 1;
|
|
+ if (!fourxm->track_count || fourxm->track_count >= UINT_MAX / sizeof(audio_track_t)) {
|
|
+ free(header);
|
|
+ return 0;
|
|
+ }
|
|
fourxm->tracks = realloc(fourxm->tracks,
|
|
fourxm->track_count * sizeof(audio_track_t));
|
|
if (!fourxm->tracks) {
|