From: David Bryant <david@wavpack.com>
Date: Sun, 26 Aug 2018 20:24:00 -0700
Subject: [PATCH] issue #41: make sure DFF chunk does not have negative length


diff --git a/cli/dsdiff.c b/cli/dsdiff.c
index fa56bbb..c65aed3 100644
--- a/cli/dsdiff.c
+++ b/cli/dsdiff.c
@@ -188,7 +188,7 @@ int ParseDsdiffHeaderConfig (FILE *infile, char *infilename, char *fourcc, Wavpa
                     cptr += sizeof (dff_chunk_header);
                     WavpackBigEndianToNative (&dff_chunk_header, DFFChunkHeaderFormat);
 
-                    if (eptr - cptr >= dff_chunk_header.ckDataSize) {
+                    if (dff_chunk_header.ckDataSize > 0 && dff_chunk_header.ckDataSize <= eptr - cptr) {
                         if (!strncmp (dff_chunk_header.ckID, "FS  ", 4) && dff_chunk_header.ckDataSize == 4) {
                             memcpy (&sampleRate, cptr, sizeof (sampleRate));
                             WavpackBigEndianToNative (&sampleRate, "L");