omadec: fix len check in nprobe() prevent out of array access

Found-by: Mateusz "j00ru" Jurczyk and Gynvael Coldwind Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
12 years ago · f1d6f013b2
parent 44c23aa1b8
commit f1d6f013b2
1 changed files with 1 additions and 1 deletions
--- a/libavformat/omadec.c
+++ b/libavformat/omadec.c
@ -159,7 +159,7 @@ static int nprobe(AVFormatContext *s, uint8_t *enc_header, int size, const uint8
    taglen = AV_RB32(&enc_header[pos+32]);
    datalen = AV_RB32(&enc_header[pos+36]) >> 4;

-    if(taglen + (((uint64_t)datalen)<<4) + 44 > size)
+    if(pos + (uint64_t)taglen + (((uint64_t)datalen)<<4) + 44 > size)
        return -1;

    pos += 44 + taglen;