From 0ecf9cc9007b49f989f4276ef517652fa734d927 Mon Sep 17 00:00:00 2001
From: Ronald S. Bultje
Date: Mon, 9 Mar 2009 13:08:19 +0000
Subject: Prevent (negative) overflow of rm->remaining_len. This evaluation
 really only has two possible outcomes: either len and rm->remaining_len are
 the same, in which case we care about the outcome and it is zero, or
 rm->remaining_len is currently not in use and we don't care about the
 outcome. In that case, len is positive and rm->remaining_len is zero, which
 leads to a negative result. This is confusing and could eventually lead to a
 sign-flip if we skip a lot of packets (unlikely, but still). Therefore, just
 always set it to zero.

Originally committed as revision 17910 to svn://svn.ffmpeg.org/ffmpeg/trunk
---
 libavformat/rmdec.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'libavformat/rmdec.c')

diff --git a/libavformat/rmdec.c b/libavformat/rmdec.c
index 39e91a5a1c..4be7397174 100644
--- a/libavformat/rmdec.c
+++ b/libavformat/rmdec.c
@@ -468,7 +468,7 @@ static int sync(AVFormatContext *s, int64_t *timestamp, int *flags, int *stream_
 skip:
             /* skip packet if unknown number */
             url_fskip(pb, len);
-            rm->remaining_len -= len;
+            rm->remaining_len = 0;
             continue;
         }
         *stream_index= i;
-- 
cgit v1.2.3