[vlc-commits] demux: avi: check chunk size

[Francois Cartegnie]

vlc | branch: master | Francois Cartegnie <fcvlcdev at free.fr> | Thu Jul 27 23:21:56 2017 +0200| [0c0a38ac26e18220b2860671b6dca90be9d5ae45] | committer: Francois Cartegnie

demux: avi: check chunk size

> http://git.videolan.org/gitweb.cgi/vlc.git/?a=commit;h=0c0a38ac26e18220b2860671b6dca90be9d5ae45
---

 modules/demux/avi/libavi.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/modules/demux/avi/libavi.c b/modules/demux/avi/libavi.c
index 35cec915f5..fc44f392e5 100644
--- a/modules/demux/avi/libavi.c
+++ b/modules/demux/avi/libavi.c
@@ -62,7 +62,9 @@ static int AVI_ChunkReadCommon( stream_t *s, avi_chunk_t *p_chk )
     p_chk->common.i_chunk_size   = GetDWLE( p_peek + 4 );
     p_chk->common.i_chunk_pos    = vlc_stream_Tell( s );
 
-    if( UINT64_MAX - p_chk->common.i_chunk_pos < p_chk->common.i_chunk_size )
+    if( p_chk->common.i_chunk_size >= UINT64_MAX - 8 ||
+        p_chk->common.i_chunk_pos > UINT64_MAX - 8 ||
+        UINT64_MAX - p_chk->common.i_chunk_pos - 8 < __EVEN(p_chk->common.i_chunk_size) )
         return VLC_EGENERIC;
 
     p_chk->common.p_father = NULL;