From 6ad52b1a11f19ce860d60d6d293267d41142bd32 Mon Sep 17 00:00:00 2001 From: Wim Taymans Date: Wed, 16 Oct 2019 10:44:12 +0200 Subject: [PATCH] iter: check if size can hold a spa_pod --- spa/include/spa/pod/iter.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/spa/include/spa/pod/iter.h b/spa/include/spa/pod/iter.h index 6b265808a..b2668bdb1 100644 --- a/spa/include/spa/pod/iter.h +++ b/spa/include/spa/pod/iter.h @@ -129,7 +129,7 @@ static inline struct spa_pod_control *spa_pod_control_next(const struct spa_pod_ static inline void *spa_pod_from_data(void *data, size_t maxsize, off_t offset, size_t size) { void *pod; - if (offset + size > maxsize) + if (size < sizeof(struct spa_pod) || offset + size > maxsize) return NULL; pod = SPA_MEMBER(data, offset, void); if (SPA_POD_SIZE(pod) > size)