diff options
| author | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2009-08-15 00:02:42 +0000 |
|---|---|---|
| committer | Reimar Döffinger <Reimar.Doeffinger@gmx.de> | 2009-08-15 00:02:42 +0000 |
| commit | ffbe087b589506cb0e671fa711e5c2c6ea203ac0 (patch) | |
| tree | 47e5245b49358eea4f8c4a3abc091a76d143227e /libavcodec/dvdsubdec.c | |
| parent | 84c1b149b22e9c370ad84b0cefc9e86bc0407c63 (diff) | |
| download | ffmpeg-ffbe087b589506cb0e671fa711e5c2c6ea203ac0.tar.gz | |
Fix cmd_pos bounds check to avoid the overflow case.
Originally committed as revision 19640 to svn://svn.ffmpeg.org/ffmpeg/trunk
Diffstat (limited to 'libavcodec/dvdsubdec.c')
| -rw-r--r-- | libavcodec/dvdsubdec.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libavcodec/dvdsubdec.c b/libavcodec/dvdsubdec.c index a99b7af858..b445d3e456 100644 --- a/libavcodec/dvdsubdec.c +++ b/libavcodec/dvdsubdec.c @@ -191,7 +191,7 @@ static int decode_dvd_subtitles(AVSubtitle *sub_header, cmd_pos = READ_OFFSET(buf + cmd_pos); - while ((cmd_pos + 2 + offset_size) < buf_size) { + while (cmd_pos > 0 && cmd_pos < buf_size - 2 - offset_size) { date = AV_RB16(buf + cmd_pos); next_cmd_pos = READ_OFFSET(buf + cmd_pos + 2); dprintf(NULL, "cmd_pos=0x%04x next=0x%04x date=%d\n", |