[libbluray-devel] Fixed buffer overflow in bd_psr_unregister_cb()

[hpi1]

libbluray | branch: master | hpi1 <hpi1 at anonymous.org> | Sat Jun 22 20:17:03 2013 +0300| [b74ed462644917e2297863b3ab584322b3e34d8d] | committer: hpi1

Fixed buffer overflow in bd_psr_unregister_cb()

> http://git.videolan.org/gitweb.cgi/libbluray.git/?a=commit;h=b74ed462644917e2297863b3ab584322b3e34d8d
---

 src/libbluray/register.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/libbluray/register.c b/src/libbluray/register.c
index c82fdbf..ff9f964 100644
--- a/src/libbluray/register.c
+++ b/src/libbluray/register.c
@@ -233,8 +233,8 @@ void bd_psr_unregister_cb(BD_REGISTERS *p, void (*callback)(void*,BD_PSR_EVENT*)
 
     while (i < p->num_cb) {
         if (p->cb[i].handle == cb_handle && p->cb[i].cb == callback) {
-            if (--p->num_cb) {
-                memmove(p->cb + i, p->cb + i + 1, sizeof(PSR_CB_DATA) * p->num_cb);
+            if (--p->num_cb && i < p->num_cb) {
+                memmove(p->cb + i, p->cb + i + 1, sizeof(PSR_CB_DATA) * (p->num_cb - i));
                 continue;
             }
         }