diff --git a/spa/include/spa/pod/compare.h b/spa/include/spa/pod/compare.h index 6ac6b0799..fa575e781 100644 --- a/spa/include/spa/pod/compare.h +++ b/spa/include/spa/pod/compare.h @@ -205,11 +205,11 @@ SPA_API_POD_COMPARE int spa_pod_compare_is_step_of(uint32_t type, const void *r1 { switch (type) { case SPA_TYPE_Int: - if (size < sizeof(int32_t)) + if (size < sizeof(int32_t) || *(int32_t *)r2 < 1) return -EINVAL; return *(int32_t *) r1 % *(int32_t *) r2 == 0; case SPA_TYPE_Long: - if (size < sizeof(int64_t)) + if (size < sizeof(int64_t) || *(int64_t *)r2 < 1) return -EINVAL; return *(int64_t *) r1 % *(int64_t *) r2 == 0; case SPA_TYPE_Rectangle: @@ -217,8 +217,12 @@ SPA_API_POD_COMPARE int spa_pod_compare_is_step_of(uint32_t type, const void *r1 const struct spa_rectangle *rec1 = (struct spa_rectangle *) r1, *rec2 = (struct spa_rectangle *) r2; - if (size < sizeof(struct spa_rectangle)) + if (size < sizeof(struct spa_rectangle) || + rec2->width < 1 || + rec2->height < 1) + { return -EINVAL; + } return (rec1->width % rec2->width == 0 && rec1->height % rec2->height == 0); }