File 0003-rmdemux-Avoid-integer-overflow-when-checking-if-enough-data.patch of Package gstreamer-plugins-ugly.43092

From cfc74588fca99328419eb16921fa559739a7b503 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sebastian=20Dr=C3=B6ge?= <sebastian@centricular.com>
Date: Wed, 11 Feb 2026 20:00:04 +0200
Subject: [PATCH] rmdemux: Avoid integer overflow when checking if enough data
 is available for video fragment

Part-of: <https://gitlab.freedesktop.org/gstreamer/gstreamer/-/merge_requests/10883>
---
 subprojects/gst-plugins-ugly/gst/realmedia/rmdemux.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/gst/realmedia/rmdemux.c b/gst/realmedia/rmdemux.c
index bc7eb87902a..8501363f83a 100644
--- a/gst/realmedia/rmdemux.c
+++ b/gst/realmedia/rmdemux.c
@@ -2348,7 +2348,8 @@ gst_rmdemux_parse_video_packet (GstRMDemux * rmdemux, GstRMDemuxStream * stream,
     }
     GST_DEBUG_OBJECT (rmdemux, "fragment size %d", fragment_size);
 
-    if (map.size < (data - map.data) + fragment_size)
+    if (fragment_size > map.size
+        || (data - map.data) > map.size - fragment_size)
       goto not_enough_data;
 
     /* get the fragment */
-- 
GitLab