[FFmpeg-cvslog] flacdec: fix buffer size checking in get_metadata_size()

[Justin Ruggles]

ffmpeg | branch: release/0.8 | Justin Ruggles <justin.ruggles at gmail.com> | Tue Sep 13 15:13:44 2011 -0400| [7fc9aa6d359e6c594a367e4db6366bc661581f56] | committer: Reinhard Tartler

flacdec: fix buffer size checking in get_metadata_size()

Adds an additional check before reading the next block header and avoids a
potential integer overflow when checking the metadata size against the
remaining buffer size.
(cherry picked from commit 4c5e7b27d57dd2be777780e840eef9be63242158)

Signed-off-by: Anton Khirnov <anton at khirnov.net>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=7fc9aa6d359e6c594a367e4db6366bc661581f56
---

 libavcodec/flacdec.c |    4 +++-
 1 files changed, 3 insertions(+), 1 deletions(-)

diff --git a/libavcodec/flacdec.c b/libavcodec/flacdec.c
index 1ce8559..7331c5c 100644
--- a/libavcodec/flacdec.c
+++ b/libavcodec/flacdec.c
@@ -228,9 +228,11 @@ static int get_metadata_size(const uint8_t *buf, int buf_size)
 
     buf += 4;
     do {
+        if (buf_end - buf < 4)
+            return 0;
         ff_flac_parse_block_header(buf, &metadata_last, NULL, &metadata_size);
         buf += 4;
-        if (buf + metadata_size > buf_end) {
+        if (buf_end - buf < metadata_size) {
             /* need more data in order to read the complete header */
             return 0;
         }