matroskadec: Check for overflows in xiph lace decoding

This also detects errors earlier

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>

1 files changed, 2 insertions, 2 deletions

diff --git a/libavformat/matroskadec.c b/libavformat/matroskadec.c
index d068453e62..39559b5cca 100644
--- a/libavformat/matroskadec.c
+++ b/libavformat/matroskadec.c
@@ -1992,18 +1992,18 @@ static int matroska_parse_laces(MatroskaDemuxContext *matroska, uint8_t **buf,
         uint32_t total = 0;
         for (n = 0; res == 0 && n < *laces - 1; n++) {
             while (1) {
-                if (size == 0) {
+                if (size <= total) {
                     res = AVERROR_INVALIDDATA;
                     break;
                 }
                 temp = *data;
+                total += temp;
                 lace_size[n] += temp;
                 data += 1;
                 size -= 1;
                 if (temp != 0xff)
                     break;
             }
-            total += lace_size[n];
         }
         if (size <= total) {
             res = AVERROR_INVALIDDATA;