From: David Bryant <david@wavpack.com> Date: Sun, 26 Aug 2018 20:24:00 -0700 Subject: issue #41: make sure DFF chunk does not have negative length --- cli/dsdiff.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cli/dsdiff.c b/cli/dsdiff.c index fa56bbb..c65aed3 100644 --- a/cli/dsdiff.c +++ b/cli/dsdiff.c @@ -188,7 +188,7 @@ int ParseDsdiffHeaderConfig (FILE *infile, char *infilename, char *fourcc, Wavpa cptr += sizeof (dff_chunk_header); WavpackBigEndianToNative (&dff_chunk_header, DFFChunkHeaderFormat); - if (eptr - cptr >= dff_chunk_header.ckDataSize) { + if (dff_chunk_header.ckDataSize > 0 && dff_chunk_header.ckDataSize <= eptr - cptr) { if (!strncmp (dff_chunk_header.ckID, "FS ", 4) && dff_chunk_header.ckDataSize == 4) { memcpy (&sampleRate, cptr, sizeof (sampleRate)); WavpackBigEndianToNative (&sampleRate, "L");