Author: spyfeng
Date: Sat Apr 10 07:17:39 2010
New Revision: 5750
Log:
check negative value for length_remaining.
Modified:
mms/mmst.c
Modified: mms/mmst.c
==============================================================================
--- mms/mmst.c Sat Apr 10 07:12:03 2010 (r5749)
+++ mms/mmst.c Sat Apr 10 07:17:39 2010 (r5750)
@@ -273,7 +273,8 @@ static MMSSCPacketType get_tcp_server_re
dprintf(NULL, "Length remaining is %d\n",
length_remaining);
// read the rest of the packet.
- if (length_remaining > sizeof(mms->incoming_buffer) - 12) {
+ if (length_remaining < 0
+ || length_remaining > sizeof(mms->incoming_buffer) -
12) {
dprintf("Incoming message len %d exceeds buffer len
%d\n",
length_remaining, sizeof(mms->incoming_buffer) -
12);
break;
@@ -308,7 +309,8 @@ static MMSSCPacketType get_tcp_server_re
mms->pkt_buf_len = length_remaining;
mms->pkt_read_ptr = mms->incoming_buffer;
- if (length_remaining > sizeof(mms->incoming_buffer)) {
+ if (length_remaining < 0
+ || length_remaining > sizeof(mms->incoming_buffer)) {
dprintf("Incoming data len %d exceeds buffer len %d\n",
length_remaining, sizeof(mms->incoming_buffer));
break;
_______________________________________________
FFmpeg-soc mailing list
[email protected]
https://lists.mplayerhq.hu/mailman/listinfo/ffmpeg-soc
