[FFmpeg-soc] [soc]: r5750 - mms/mmst.c

[spyfeng]

Author: spyfeng
Date: Sat Apr 10 07:17:39 2010
New Revision: 5750

Log:
check negative value for length_remaining.

Modified:
   mms/mmst.c

Modified: mms/mmst.c
==============================================================================
--- mms/mmst.c	Sat Apr 10 07:12:03 2010	(r5749)
+++ mms/mmst.c	Sat Apr 10 07:17:39 2010	(r5750)
@@ -273,7 +273,8 @@ static MMSSCPacketType get_tcp_server_re
 
                     dprintf(NULL, "Length remaining is %d\n", length_remaining);
                     // read the rest of the packet.
-                    if (length_remaining > sizeof(mms->incoming_buffer) - 12) {
+                    if (length_remaining < 0
+                        || length_remaining > sizeof(mms->incoming_buffer) - 12) {
                         dprintf("Incoming message len %d exceeds buffer len %d\n",
                             length_remaining, sizeof(mms->incoming_buffer) - 12);
                         break;
@@ -308,7 +309,8 @@ static MMSSCPacketType get_tcp_server_re
                 mms->pkt_buf_len          = length_remaining;
                 mms->pkt_read_ptr         = mms->incoming_buffer;
 
-                if (length_remaining > sizeof(mms->incoming_buffer)) {
+                if (length_remaining < 0
+                        || length_remaining > sizeof(mms->incoming_buffer)) {
                     dprintf("Incoming data len %d exceeds buffer len %d\n",
                             length_remaining, sizeof(mms->incoming_buffer));
                     break;