aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorwm4 <nfxjfg@googlemail.com>2015-02-03 19:04:11 +0100
committerMichael Niedermayer <michaelni@gmx.at>2015-02-04 01:05:26 +0100
commit55b75ece704395b5580dabcd3f426f51ed82ee3c (patch)
treeba8d25eba3b5894e64e5866b38e0aab61f979701
parent28f303542e90bc34f96e2e04af6f1b9e9b9d65ab (diff)
downloadffmpeg-55b75ece704395b5580dabcd3f426f51ed82ee3c.tar.gz
avformat/mpc8: fix broken pointer math
This could overflow and crash at least on 32 bit systems. Reviewed-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de> Signed-off-by: Michael Niedermayer <michaelni@gmx.at> (cherry picked from commit b737a2c52857b214be246ff615c6293730033cfa) Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
-rw-r--r--libavformat/mpc8.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/libavformat/mpc8.c b/libavformat/mpc8.c
index 31026fef1c..6ef8cab955 100644
--- a/libavformat/mpc8.c
+++ b/libavformat/mpc8.c
@@ -91,7 +91,7 @@ static int mpc8_probe(AVProbeData *p)
size = bs_get_v(&bs);
if (size < 2)
return 0;
- if (bs + size - 2 >= bs_end)
+ if (size >= bs_end - bs + 2)
return AVPROBE_SCORE_EXTENSION - 1; // seems to be valid MPC but no header yet
if (header_found) {
if (size < 11 || size > 28)