From de41d5372faa4ad7ad439e71975fc6f4ea0c0efc Mon Sep 17 00:00:00 2001 From: Michael Niedermayer Date: Sun, 15 Mar 2015 18:20:58 +0100 Subject: [PATCH] avcodec/dvbsub_parser: Fix potential pointer overflows Signed-off-by: Michael Niedermayer --- libavcodec/dvbsub_parser.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/libavcodec/dvbsub_parser.c b/libavcodec/dvbsub_parser.c index d15c89150f..f9fdb6a8b9 100644 --- a/libavcodec/dvbsub_parser.c +++ b/libavcodec/dvbsub_parser.c @@ -122,11 +122,11 @@ static int dvbsub_parse(AVCodecParserContext *s, { if (*p == 0x0f) { - if (p + 6 <= p_end) + if (6 <= p_end - p) { len = AV_RB16(p + 4); - if (p + len + 6 <= p_end) + if (len + 6 <= p_end - p) { *poutbuf_size += len + 6; @@ -136,7 +136,7 @@ static int dvbsub_parse(AVCodecParserContext *s, } else break; } else if (*p == 0xff) { - if (p + 1 < p_end) + if (1 < p_end - p) { av_dlog(avctx, "Junk at end of packet\n"); }