avformat/mpegvideodec: fix hypothetical pointer overflow in mpegvideo_probe()
authorMichael Niedermayer <michaelni@gmx.at>
Sun, 15 Mar 2015 12:39:56 +0000 (13:39 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Sun, 15 Mar 2015 12:39:56 +0000 (13:39 +0100)
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/mpegvideodec.c

index 5ea5569..aca9621 100644 (file)
@@ -52,11 +52,11 @@ static int mpegvideo_probe(AVProbeData *p)
                 j = -1;
                 if (ptr[j + 8] & 2)
                     j+= 64;
-                if (ptr + j >= end)
+                if (j >= end - ptr)
                     break;
                 if (ptr[j + 8] & 1)
                     j+= 64;
-                if (ptr + j >= end)
+                if (j >= end - ptr)
                     break;
                 if (AV_RB24(ptr + j + 9) & 0xFFFFFE)
                     break;