diff options
| author | Michael Niedermayer <michaelni@gmx.at> | 2015-03-15 13:45:31 +0100 |
|---|---|---|
| committer | Michael Niedermayer <michaelni@gmx.at> | 2015-03-15 13:45:31 +0100 |
| commit | 2cda1a16d0d34f1e936ed179c6f864bae1026b06 (patch) | |
| tree | 97f4ac62071e3aeb3c6256808776235176448432 /libavformat/dvbsub.c | |
| parent | 32c4b504b4ba16ef05ab474541150c39f758746c (diff) | |
| download | ffmpeg-2cda1a16d0d34f1e936ed179c6f864bae1026b06.tar.gz | |
avformat/dvbsub: Fix hypothetical pointer overflow in dvbsub_probe()
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
Diffstat (limited to 'libavformat/dvbsub.c')
| -rw-r--r-- | libavformat/dvbsub.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/libavformat/dvbsub.c b/libavformat/dvbsub.c index d52bc861eb..3d2f704c49 100644 --- a/libavformat/dvbsub.c +++ b/libavformat/dvbsub.c @@ -37,7 +37,7 @@ static int dvbsub_probe(AVProbeData *p) const uint8_t *ptr = p->buf + i; uint8_t histogram[6] = {0}; int min = 255; - for(j=0; ptr + 6 < end; j++) { + for(j=0; 6 < end - ptr; j++) { if (*ptr != 0x0f) break; type = ptr[1]; @@ -49,6 +49,8 @@ static int dvbsub_probe(AVProbeData *p) histogram[type - 0x10] ++; } else break; + if (6 + len > end - ptr) + break; ptr += 6 + len; } for (k=0; k < 4; k++) { |