avformat/mpc8: fix broken pointer math

This could overflow and crash at least on 32 bit systems. Reviewed-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de> Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
10 years ago · b737a2c528
parent 56cc024220
commit b737a2c528
1 changed files with 1 additions and 1 deletions
--- a/libavformat/mpc8.c
+++ b/libavformat/mpc8.c
@ -91,7 +91,7 @@ static int mpc8_probe(AVProbeData *p)
        size = bs_get_v(&bs);
        if (size < 2)
            return 0;
-        if (bs + size - 2 >= bs_end)
+        if (size >= bs_end - bs + 2)
            return AVPROBE_SCORE_EXTENSION - 1; // seems to be valid MPC but no header yet
        if (header_found) {
            if (size < 11 || size > 28)