Boundary check

diff --git a/modules/demux/smf.c b/modules/demux/smf.c
index 7482724d24123187d4d8a3a49d8e9f0509e70cb9..088960e530af615433129ff2a7ca7df59e3c0e4e 100644 (file)
--- a/modules/demux/smf.c
+++ b/modules/demux/smf.c
@@ -263,6 +263,7 @@ int HandleMeta (demux_t *p_demux, mtrk_t *tr)
     uint8_t *payload;
     uint8_t type;
     int32_t length;
+    int ret = 0;
 
     if (stream_Read (s, &type, 1) != 1)
         return -1;
@@ -333,17 +334,21 @@ int HandleMeta (demux_t *p_demux, mtrk_t *tr)
             if (tr->end != stream_Tell (s))
             {
                 msg_Err (p_demux, "misplaced end of track");
-                stream_Seek (s, tr->end);
+                ret = -1;
             }
             break;
 
         case 0x51: /* Tempo */
-        {
-            uint32_t tempo = (payload[0] << 16) | (payload[1] << 8) | payload[2];
-            /* FIXME: change date */
-            msg_Dbg (p_demux, "new tempo: %u", (unsigned)tempo);
+            if (length == 3)
+            {
+                uint32_t tempo = (payload[0] << 16)
+                               | (payload[1] << 8) | payload[2];
+                /* FIXME: change date */
+                msg_Dbg (p_demux, "new tempo: %u", (unsigned)tempo);
+            }
+            else
+                ret = -1;
             break;
-        }
 
         case 0x54: /* SMPTE offset */
         case 0x58: /* Time signature */