Commit e2e66404 authored by Max Kellermann's avatar Max Kellermann

decoder/DsdLib: fix integer overflow in ID3 size calculation

parent 3ecb19d0
......@@ -117,13 +117,15 @@ dsdlib_tag_id3(InputStream &is,
if (tagoffset >= size)
return;
const id3_length_t count = size - tagoffset;
if (count < 10 || count > 1024 * 1024)
const auto count64 = size - tagoffset;
if (count64 < 10 || count64 > 1024 * 1024)
return;
if (!dsdlib_skip_to(nullptr, is, tagoffset))
return;
const id3_length_t count = count64;
id3_byte_t *const id3_buf = new id3_byte_t[count];
if (id3_buf == nullptr)
return;
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment