wav: fix integer underflow

(cherry picked from commit 105335dd73917555335c03460aaa67fcdb9d4a55)

diff --git a/modules/demux/wav.c b/modules/demux/wav.c
index 045344a08e25ddd2e6a934c5429b208c5b101b73..e174ac4a5fd7525c2d05d27959b816b581ccc7ab 100644 (file)
--- a/modules/demux/wav.c
+++ b/modules/demux/wav.c
@@ -178,7 +178,9 @@ static int Open( vlc_object_t * p_this )
     /* see the following link for more information:
      * http://www.microsoft.com/whdc/device/audio/multichaud.mspx#EFAA */
     if( GetWLE( &p_wf->wFormatTag ) == WAVE_FORMAT_EXTENSIBLE &&
-        i_size >= sizeof( WAVEFORMATEXTENSIBLE ) )
+        i_size >= sizeof( WAVEFORMATEXTENSIBLE ) &&
+        ( p_sys->fmt.i_extra + sizeof( WAVEFORMATEX )
+            >= sizeof( WAVEFORMATEXTENSIBLE ) ) )
     {
         unsigned i, i_channel_mask;
         GUID guid_subformat;