Fix from speex svn 14504.
authorGregory Maxwell <gmaxwell@cherenkov.myrandomnode.dyndns.org>
Thu, 14 Feb 2008 21:11:37 +0000 (16:11 -0500)
committerJean-Marc Valin <jean-marc.valin@usherbrooke.ca>
Thu, 14 Feb 2008 21:18:12 +0000 (08:18 +1100)
tools/celtdec.c

index 228aeaa..9e99116 100644 (file)
@@ -104,7 +104,7 @@ static void print_comments(char *comments, int length)
    end = c+length;
    len=readint(c, 0);
    c+=4;
-   if (c+len>end)
+   if (len < 0 || c+len>end)
    {
       fprintf (stderr, "Invalid/corrupted comments\n");
       return;
@@ -128,7 +128,7 @@ static void print_comments(char *comments, int length)
       }
       len=readint(c, 0);
       c+=4;
-      if (c+len>end)
+      if (len < 0 || c+len>end)
       {
          fprintf (stderr, "Invalid/corrupted comments\n");
          return;