[vlc-commits] mp4: fix integer underflow

[Rémi Denis-Courmont]

vlc/vlc-3.0 | branch: master | Rémi Denis-Courmont <remi at remlab.net> | Thu Jun 27 23:19:38 2019 +0300| [3d908809f7b315061bae5df8c9c16b5df6f86ec7] | committer: Rémi Denis-Courmont

mp4: fix integer underflow

Reported-by: Hyeon-Ju Lee <zorurione at gmail.com>
(cherry picked from commit b2b157076d9e94df34502dd8df0787deb940e938)

> http://git.videolan.org/gitweb.cgi/vlc/vlc-3.0.git/?a=commit;h=3d908809f7b315061bae5df8c9c16b5df6f86ec7
---

 modules/demux/mp4/mp4.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/modules/demux/mp4/mp4.c b/modules/demux/mp4/mp4.c
index edda423bed..0c7aa2dd50 100644
--- a/modules/demux/mp4/mp4.c
+++ b/modules/demux/mp4/mp4.c
@@ -421,11 +421,11 @@ static block_t * MP4_EIA608_Convert( block_t * p_block )
     block_t *p_newblock;
 
     /* always need at least 10 bytes (atom size+header+1pair)*/
-    if ( i_remaining < 10 ||
-         !(i_bytes = GetDWBE(p_block->p_buffer)) ||
-         (i_bytes > i_remaining) ||
-         memcmp("cdat", &p_block->p_buffer[4], 4) ||
-         !(p_newblock = block_Alloc( i_remaining * 3 - 8 )) )
+    i_bytes = GetDWBE(p_block->p_buffer);
+
+    if (10 < i_bytes || i_bytes < i_remaining ||
+        memcmp("cdat", &p_block->p_buffer[4], 4) ||
+        (p_newblock = block_Alloc(i_remaining * 3 - 8)) == NULL)
     {
         p_block->i_buffer = 0;
         return p_block;