highperfocused/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

avformat/dvbsub: Fix hypothetical pointer overflow in dvbsub_probe()

Browse Source 
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
Michael Niedermayer
2015-03-15 13:45:31 +01:00
parent 32c4b504b4
commit 2cda1a16d0
1 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
libavformat/dvbsub.c
View File

@@ -37,7 +37,7 @@ static int dvbsub_probe(AVProbeData *p)
const uint8_t *ptr = p->buf + i; const uint8_t *ptr = p->buf + i;
uint8_t histogram[6] = {0}; uint8_t histogram[6] = {0};
int min = 255; int min = 255;
for(j=0; ptr + 6 < end; j++) { for(j=0; 6 < end - ptr; j++) {
if (*ptr != 0x0f) if (*ptr != 0x0f)
break; break;
type = ptr[1]; type = ptr[1];
@@ -49,6 +49,8 @@ static int dvbsub_probe(AVProbeData *p)
histogram[type - 0x10] ++; histogram[type - 0x10] ++;
} else } else
break; break;
if (6 + len > end - ptr)
break;
ptr += 6 + len; ptr += 6 + len;
} }
for (k=0; k < 4; k++) { for (k=0; k < 4; k++) {