www-client/seamonkey/files/seamonkey-2.30-webm-disallow-negative-samples.patch


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

--- a/mozilla/content/media/webm/WebMReader.cpp	2014-10-20 21:59:39.000000000 -0400
+++ b/mozilla/content/media/webm/WebMReader.cpp	2014-10-28 09:06:51.959665416 -0400
@@ -668,7 +668,15 @@
           return true;
         }
         int32_t keepFrames = frames - skipFrames;
+        if (keepFrames < 0) {
+          NS_WARNING("Int overflow in keepFrames");
+          return false;
+	}
         int samples = keepFrames * channels;
+	if (samples < 0) {
+          NS_WARNING("Int overflow in samples");
+          return false;
+	}
         nsAutoArrayPtr<AudioDataValue> trimBuffer(new AudioDataValue[samples]);
         for (int i = 0; i < samples; i++)
           trimBuffer[i] = buffer[skipFrames*channels + i];
@@ -691,6 +699,10 @@
         int32_t keepFrames = frames - discardFrames.value();
         if (keepFrames > 0) {
           int samples = keepFrames * channels;
+          if (samples < 0) {
+            NS_WARNING("Int overflow in samples");
+            return false;
+          }
           nsAutoArrayPtr<AudioDataValue> trimBuffer(new AudioDataValue[samples]);
           for (int i = 0; i < samples; i++)
             trimBuffer[i] = buffer[i];