[vlc-commits] commit: Fixed signed integer overflow when loading AVI ODML index. ( Laurent Aimar )

[git at videolan.org]

vlc/vlc-1.0 | branch: master | Laurent Aimar <fenrir at videolan.org> | Tue Feb 23 22:43:20 2010 +0100| [5b3d322580cb6dfd3259a9017606b4024290d30b] | committer: Rémi Denis-Courmont 

Fixed signed integer overflow when loading AVI ODML index.

(cherry picked from commit 8e16fb45f4e4b8b745b180e3b84ba2a8b9ffff76)
Signed-off-by: Rémi Denis-Courmont <remi at remlab.net>

> http://git.videolan.org/gitweb.cgi/vlc/vlc-1.0.git/?a=commit;h=5b3d322580cb6dfd3259a9017606b4024290d30b
---

 modules/demux/avi/avi.c    |    8 +++-----
 modules/demux/avi/libavi.h |    8 ++++----
 2 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/modules/demux/avi/avi.c b/modules/demux/avi/avi.c
index acf6760..6d2e304 100644
--- a/modules/demux/avi/avi.c
+++ b/modules/demux/avi/avi.c
@@ -2269,12 +2269,11 @@ static void __Parse_indx( demux_t    *p_demux,
 {
     demux_sys_t         *p_sys    = p_demux->p_sys;
     avi_entry_t     index;
-    int32_t             i;
 
     msg_Dbg( p_demux, "loading subindex(0x%x) %d entries", p_indx->i_indextype, p_indx->i_entriesinuse );
     if( p_indx->i_indexsubtype == 0 )
     {
-        for( i = 0; i < p_indx->i_entriesinuse; i++ )
+        for( unsigned i = 0; i < p_indx->i_entriesinuse; i++ )
         {
             index.i_id      = p_indx->i_id;
             index.i_flags   = p_indx->idx.std[i].i_size & 0x80000000 ? 0 : AVIIF_KEYFRAME;
@@ -2286,7 +2285,7 @@ static void __Parse_indx( demux_t    *p_demux,
     }
     else if( p_indx->i_indexsubtype == AVI_INDEX_2FIELD )
     {
-        for( i = 0; i < p_indx->i_entriesinuse; i++ )
+        for( unsigned i = 0; i < p_indx->i_entriesinuse; i++ )
         {
             index.i_id      = p_indx->i_id;
             index.i_flags   = p_indx->idx.field[i].i_size & 0x80000000 ? 0 : AVIIF_KEYFRAME;
@@ -2306,7 +2305,6 @@ static void AVI_IndexLoad_indx( demux_t *p_demux )
 {
     demux_sys_t         *p_sys = p_demux->p_sys;
     unsigned int        i_stream;
-    int32_t             i;
 
     avi_chunk_list_t    *p_riff;
     avi_chunk_list_t    *p_hdrl;
@@ -2337,7 +2335,7 @@ static void AVI_IndexLoad_indx( demux_t *p_demux )
         else if( p_indx->i_indextype == AVI_INDEX_OF_INDEXES )
         {
             avi_chunk_t    ck_sub;
-            for( i = 0; i < p_indx->i_entriesinuse; i++ )
+            for( unsigned i = 0; i < p_indx->i_entriesinuse; i++ )
             {
                 if( stream_Seek( p_demux->s, p_indx->idx.super[i].i_offset )||
                     AVI_ChunkRead( p_demux->s, &ck_sub, NULL  ) )
diff --git a/modules/demux/avi/libavi.h b/modules/demux/avi/libavi.h
index 3bdc04c..7631914 100644
--- a/modules/demux/avi/libavi.h
+++ b/modules/demux/avi/libavi.h
@@ -174,10 +174,10 @@ typedef struct
 typedef struct avi_chunk_indx_s
 {
     AVI_CHUNK_COMMON
-    int16_t i_longsperentry;
-    int8_t  i_indexsubtype;
-    int8_t  i_indextype;
-    int32_t i_entriesinuse;
+    int16_t  i_longsperentry;
+    int8_t   i_indexsubtype;
+    int8_t   i_indextype;
+    uint32_t i_entriesinuse;
     vlc_fourcc_t i_id;
 
     int64_t i_baseoffset;