avformat/dvbsub: Fix hypothetical pointer overflow in dvbsub_probe()

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
10 years ago · 2cda1a16d0
parent 32c4b504b4
commit 2cda1a16d0
1 changed files with 3 additions and 1 deletions
--- a/libavformat/dvbsub.c
+++ b/libavformat/dvbsub.c
@ -37,7 +37,7 @@ static int dvbsub_probe(AVProbeData *p)
            const uint8_t *ptr = p->buf + i;
            uint8_t histogram[6] = {0};
            int min = 255;
-            for(j=0; ptr + 6 < end; j++) {
+            for(j=0; 6 < end - ptr; j++) {
                if (*ptr != 0x0f)
                    break;
                type    = ptr[1];
@ -49,6 +49,8 @@ static int dvbsub_probe(AVProbeData *p)
                    histogram[type - 0x10] ++;
                } else
                    break;
+                if (6 + len > end - ptr)
+                    break;
                ptr += 6 + len;
            }
            for (k=0; k < 4; k++) {