diff --git a/modules/demux/smf.c b/modules/demux/smf.c index 9839184a3920ba9834104da5f4117dcb4210f36a..e52225be76d36ddacbbb510abdfcf17064a67815 100644 --- a/modules/demux/smf.c +++ b/modules/demux/smf.c @@ -330,20 +330,21 @@ int HandleMessage (demux_t *p_demux, mtrk_t *tr, es_out_t *out) block->p_buffer[0] = event; if (first & 0x80) { - vlc_stream_Read (s, block->p_buffer + 1, datalen); + if (vlc_stream_Read(s, block->p_buffer + 1, datalen) < datalen) + goto error; } else { if (datalen == 0) - { + { /* implicit running status requires non-empty payload */ msg_Err (p_demux, "malformatted MIDI event"); - block_Release(block); - return -1; /* implicit running status requires non-empty payload */ + goto error; } block->p_buffer[1] = first; - if (datalen > 1) - vlc_stream_Read (s, block->p_buffer + 2, datalen - 1); + if (datalen > 1 + && vlc_stream_Read(s, block->p_buffer + 2, datalen - 1) < datalen - 1) + goto error; } send: @@ -360,6 +361,10 @@ skip: tr->offset = vlc_stream_Tell (s) - tr->start; return 0; + +error: + block_Release(block); + return -1; } static int SeekSet0 (demux_t *demux)