matroskamux: fix possible crash with malformed dirac codec_data

Since size is unsigned, we need to safeguard against wrapping below zero.
This commit is contained in:
René Stadler 2011-10-11 22:10:27 +02:00
parent 6082f27d48
commit 6fc85e6c9d

View file

@ -2594,7 +2594,7 @@ gst_matroska_mux_handle_dirac_packet (GstMatroskaMux * mux,
next_parse_offset = GST_READ_UINT32_BE (data + 5);
if (G_UNLIKELY (next_parse_offset == 0))
if (G_UNLIKELY (next_parse_offset == 0 || next_parse_offset > size))
break;
data += next_parse_offset;