decoder/mad: fix integer underflow with very small files

When drop_start_samples and drop_end_samples overlap and are greater than the actual number of samples, the `num_samples` calculation in SubmitPCM() could underflow. Closes https://github.com/MusicPlayerDaemon/MPD/issues/1712

decoder/mad: fix integer underflow with very small files
15a1973e · Max Kellermann · ad7d47a8 · 15a1973e · 15a1973e
Commit 15a1973e authored Jan 17, 2023 by Max Kellermann
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 1 deletion

NEWS NEWS +2 -0

MadDecoderPlugin.cxx src/decoder/plugins/MadDecoderPlugin.cxx +1 -1

No files found.
--- a/NEWS
+++ b/NEWS
 ver 0.23.12 (not yet released)
 * input
  - curl: require CURL 7.55.0 or later
+* decoder
+  - mad: fix integer underflow with very small files
 * tags
  - fix crash bug due to race condition
 * output

--- a/src/decoder/plugins/MadDecoderPlugin.cxx
+++ b/src/decoder/plugins/MadDecoderPlugin.cxx
@@ -843,7 +843,7 @@ MadDecoder::SynthAndSubmit() noexcept
 	size_t pcm_length = synth.pcm.length;
 	if (drop_end_samples &&
 	    current_frame == max_frames - drop_end_frames - 1) {
-		if (drop_end_samples >= pcm_length)
+		if (i + drop_end_samples >= pcm_length)
 			return DecoderCommand::STOP;

 		pcm_length -= drop_end_samples;