From d97af9aeb77ec6a505fc37a5a55c5ae85bb6ea35 Mon Sep 17 00:00:00 2001
From: =?utf8?q?R=C3=A9mi=20Denis-Courmont?= <rdenis@simphalempin.com>
Date: Sat, 28 Jun 2008 14:10:15 +0300
Subject: [PATCH] wav: fix integer underflow (cherry picked from commit
 105335dd73917555335c03460aaa67fcdb9d4a55)

---
 modules/demux/wav.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/modules/demux/wav.c b/modules/demux/wav.c
index 045344a08e..e174ac4a5f 100644
--- a/modules/demux/wav.c
+++ b/modules/demux/wav.c
@@ -178,7 +178,9 @@ static int Open( vlc_object_t * p_this )
     /* see the following link for more information:
      * http://www.microsoft.com/whdc/device/audio/multichaud.mspx#EFAA */
     if( GetWLE( &p_wf->wFormatTag ) == WAVE_FORMAT_EXTENSIBLE &&
-        i_size >= sizeof( WAVEFORMATEXTENSIBLE ) )
+        i_size >= sizeof( WAVEFORMATEXTENSIBLE ) &&
+        ( p_sys->fmt.i_extra + sizeof( WAVEFORMATEX )
+            >= sizeof( WAVEFORMATEXTENSIBLE ) ) )
     {
         unsigned i, i_channel_mask;
         GUID guid_subformat;
-- 
2.39.5