wav_seek_tag: fix integer overflow

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

diff --git a/libavformat/wavdec.c b/libavformat/wavdec.c
index 2c98d89394c5a4ba4fd9358739fddc2e61aee74f..874847e042020de759ca3e5d87826328adf199d9 100644 (file)
--- a/libavformat/wavdec.c
+++ b/libavformat/wavdec.c
@@ -64,7 +64,9 @@ static int64_t next_tag(AVIOContext *pb, uint32_t *tag)
 /* RIFF chunks are always on a even offset. */
 static int64_t wav_seek_tag(AVIOContext *s, int64_t offset, int whence)
 {
-    return avio_seek(s, offset + (offset & 1), whence);
+    offset += offset < INT64_MAX && offset & 1;
+
+    return avio_seek(s, offset, whence);
 }
 
 /* return the size of the found tag */
@@ -366,9 +368,6 @@ static int wav_read_header(AVFormatContext *s)
             break;
         }
 
-        /* skip padding byte */
-        next_tag_ofs += (next_tag_ofs < INT64_MAX && next_tag_ofs & 1);
-
         /* seek to next tag unless we know that we'll run into EOF */
         if ((avio_size(pb) > 0 && next_tag_ofs >= avio_size(pb)) ||
             wav_seek_tag(pb, next_tag_ofs, SEEK_SET) < 0) {