From 09602dbe7a6400e12a66001be5223298f3dc7c56 Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Mon, 6 May 2013 10:58:31 +0200 Subject: [PATCH] wav_seek_tag: fix integer overflow Signed-off-by: Michael Niedermayer --- libavformat/wavdec.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c index 2c98d89394..874847e042 100644 --- a/libavformat/wavdec.c +++ b/libavformat/wavdec.c @@ -64,7 +64,9 @@ static int64_t next_tag(AVIOContext *pb, uint32_t *tag) /* RIFF chunks are always on a even offset. */ static int64_t wav_seek_tag(AVIOContext *s, int64_t offset, int whence) { - return avio_seek(s, offset + (offset & 1), whence); + offset += offset < INT64_MAX && offset & 1; + + return avio_seek(s, offset, whence); } /* return the size of the found tag */ @@ -366,9 +368,6 @@ static int wav_read_header(AVFormatContext *s) break; } - /* skip padding byte */ - next_tag_ofs += (next_tag_ofs < INT64_MAX && next_tag_ofs & 1); - /* seek to next tag unless we know that we'll run into EOF */ if ((avio_size(pb) > 0 && next_tag_ofs >= avio_size(pb)) || wav_seek_tag(pb, next_tag_ofs, SEEK_SET) < 0) {