XSPF: fix realloc() integer overflow

[vlc] / modules / demux / playlist / asx.c

diff --git a/modules/demux/playlist/asx.c b/modules/demux/playlist/asx.c
index a8dfe42d550a656fd1034604058daf26ceb5fcd5..caf85771d9743e63cc197198f26a9287cc66a619 100644 (file)
--- a/modules/demux/playlist/asx.c
+++ b/modules/demux/playlist/asx.c
@@ -439,11 +439,15 @@ static int Demux( demux_t *p_demux )
                     }
                     else continue;
                 }
-                if( ( psz_parse = strcasestr( psz_parse, "/>" ) ) )
-                    psz_parse += 2;
-                else if( ( psz_parse = strcasestr( psz_parse, "</MoreInfo>") ) )
-                    psz_parse += 11;
-                else continue;
+                if( ( psz_backup = strcasestr( psz_parse, "/>" ) ) )
+                    psz_parse = psz_backup + 2;
+                else if( ( psz_backup = strcasestr( psz_parse, "</MoreInfo>") ) )
+                    psz_parse = psz_backup + 11;
+                else
+                {
+                    psz_parse = NULL;
+                    continue;
+                }
             }
             else if( !strncasecmp( psz_parse, "<ABSTRACT>", 10 ) )
             {
@@ -483,7 +487,6 @@ static int Demux( demux_t *p_demux )
                 }
                 if( ( psz_parse = strcasestr( psz_parse, "/>" ) ) )
                     psz_parse += 2;
-                else continue;
             }
             else if( !strncasecmp( psz_parse, "</Entry>", 8 ) )
             {
@@ -568,8 +571,8 @@ static int Demux( demux_t *p_demux )
                         {
                             if( uniq_entry_ad_backup != NULL )
                             {
-                                uniq_entry_ad_backup = NULL;
                                 vlc_gc_decref( uniq_entry_ad_backup );
+                                uniq_entry_ad_backup = NULL;
                             }
                             input_item_node_AppendItem( p_subitems, p_entry );
                             vlc_gc_decref( p_entry );