- Added a length check.

diff --git a/src/seq/seq.c b/src/seq/seq.c
index 0cc73f774bc8a19299f5cae08e07faf3abf50277..c0774d21b8c34e91a5dda7d6e609934393651ec7 100644 (file)
--- a/src/seq/seq.c
+++ b/src/seq/seq.c
@@ -732,6 +732,8 @@ int snd_seq_event_output_buffer(snd_seq_t *seq, snd_seq_event_t *ev)
        len = snd_seq_event_length(ev);
        if (len < 0)
                return -EINVAL;
+       if ((size_t) len >= seq->obufsize)
+               return -EINVAL;
        if ((seq->obufsize - seq->obufused) < (size_t) len)
                return -EAGAIN;
        memcpy(seq->obuf + seq->obufused, ev, sizeof(snd_seq_event_t));