[vlc-commits] png: Check length before read

[Edward Wang]

vlc/vlc-1.1 | branch: master | Edward Wang <edward.c.wang at compdigitec.com> | Sun Oct 14 18:58:18 2012 -0400| [bf43a25f545f3597092ed6ba53b38b69bb6a4a00] | committer: Rémi Denis-Courmont

png: Check length before read

Signed-off-by: Jean-Baptiste Kempf <jb at videolan.org>
(cherry picked from commit b3b751cb99df71e3c0a18bcb38b4691cf98265fe)

Signed-off-by: Rémi Denis-Courmont <remi at remlab.net>

> http://git.videolan.org/gitweb.cgi/vlc/vlc-1.1.git/?a=commit;h=bf43a25f545f3597092ed6ba53b38b69bb6a4a00
---

 modules/codec/png.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/modules/codec/png.c b/modules/codec/png.c
index acd5694..ced4016 100644
--- a/modules/codec/png.c
+++ b/modules/codec/png.c
@@ -91,12 +91,14 @@ static int OpenDecoder( vlc_object_t *p_this )
 static void user_read( png_structp p_png, png_bytep data, png_size_t i_length )
 {
     block_t *p_block = (block_t *)png_get_io_ptr( p_png );
-    png_size_t i_read = __MIN( p_block->i_buffer, i_length );
+    if( i_length > p_block->i_buffer ) {
+        png_error( p_png, "not enough data" );
+        return;
+    }
+
     memcpy( data, p_block->p_buffer, i_length );
     p_block->p_buffer += i_length;
     p_block->i_buffer -= i_length;
-
-    if( i_length != i_read ) png_error( p_png, "not enough data" );
 }
 
 static void user_error( png_structp p_png, png_const_charp error_msg )