diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-03-15 18:20:58 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-03-15 20:26:08 +0100 |
| commit | de41d5372faa4ad7ad439e71975fc6f4ea0c0efc (patch) | |
| tree | a40881907128d7c73c8b9288fe33ddcce17155c8 | |
| parent | 84da9339c21f679836a024ce86a69c6ea4a6fd11 (diff) | |
| download | ffmpeg-de41d5372faa4ad7ad439e71975fc6f4ea0c0efc.tar.gz | |
avcodec/dvbsub_parser: Fix potential pointer overflows
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
| -rw-r--r-- | libavcodec/dvbsub_parser.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/libavcodec/dvbsub_parser.c b/libavcodec/dvbsub_parser.c index d15c89150f..f9fdb6a8b9 100644 --- a/libavcodec/dvbsub_parser.c +++ b/libavcodec/dvbsub_parser.c @@ -122,11 +122,11 @@ static int dvbsub_parse(AVCodecParserContext *s, { if (*p == 0x0f) { - if (p + 6 <= p_end) + if (6 <= p_end - p) { len = AV_RB16(p + 4); - if (p + len + 6 <= p_end) + if (len + 6 <= p_end - p) { *poutbuf_size += len + 6; @@ -136,7 +136,7 @@ static int dvbsub_parse(AVCodecParserContext *s, } else break; } else if (*p == 0xff) { - if (p + 1 < p_end) + if (1 < p_end - p) { av_dlog(avctx, "Junk at end of packet\n"); } |