84eede9775
PR: 134246 Submitted by: Eygene Ryabinkin <rea-fbsd@codelabs.ru> Security: http://www.vuxml.org/freebsd/6a245f31-4254-11de-b67a-0030843d3802.html http://www.vuxml.org/freebsd/48aab1d0-4252-11de-b67a-0030843d3802.html
27 lines
696 B
Text
27 lines
696 B
Text
--- src/player.c
|
|
+++ src/player.c
|
|
@@ -23,6 +23,7 @@
|
|
|
|
#include <stdio.h>
|
|
#include <stdlib.h>
|
|
+#include <stdint.h>
|
|
#include <string.h>
|
|
#include <math.h>
|
|
|
|
@@ -132,8 +133,14 @@
|
|
}
|
|
}
|
|
|
|
-/* P->Parameters = (unsigned char*) wmf_malloc (API,(MAX_REC_SIZE(API)-3) * 2 * sizeof (unsigned char));
|
|
- */ P->Parameters = (unsigned char*) wmf_malloc (API,(MAX_REC_SIZE(API) ) * 2 * sizeof (unsigned char));
|
|
+ if (MAX_REC_SIZE(API) > UINT32_MAX / 2)
|
|
+ {
|
|
+ API->err = wmf_E_InsMem;
|
|
+ WMF_DEBUG (API,"bailing...");
|
|
+ return (API->err);
|
|
+ }
|
|
+
|
|
+ P->Parameters = (unsigned char*) wmf_malloc (API,(MAX_REC_SIZE(API) ) * 2 * sizeof (unsigned char));
|
|
|
|
if (ERR (API))
|
|
{ WMF_DEBUG (API,"bailing...");
|