From de41d5372faa4ad7ad439e71975fc6f4ea0c0efc Mon Sep 17 00:00:00 2001
From: Michael Niedermayer <michaelni@gmx.at>
Date: Sun, 15 Mar 2015 18:20:58 +0100
Subject: [PATCH] avcodec/dvbsub_parser: Fix potential pointer overflows
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
---
libavcodec/dvbsub_parser.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/libavcodec/dvbsub_parser.c b/libavcodec/dvbsub_parser.c
index d15c89150f..f9fdb6a8b9 100644
--- a/libavcodec/dvbsub_parser.c
+++ b/libavcodec/dvbsub_parser.c
@@ -122,11 +122,11 @@ static int dvbsub_parse(AVCodecParserContext *s,
{
if (*p == 0x0f)
{
- if (p + 6 <= p_end)
+ if (6 <= p_end - p)
{
len = AV_RB16(p + 4);
- if (p + len + 6 <= p_end)
+ if (len + 6 <= p_end - p)
{
*poutbuf_size += len + 6;
@@ -136,7 +136,7 @@ static int dvbsub_parse(AVCodecParserContext *s,
} else
break;
} else if (*p == 0xff) {
- if (p + 1 < p_end)
+ if (1 < p_end - p)
{
av_dlog(avctx, "Junk at end of packet\n");
}