avformat/mpc8: fix broken pointer math
authorwm4 <nfxjfg@googlemail.com>
Tue, 3 Feb 2015 18:04:11 +0000 (19:04 +0100)
committerMichael Niedermayer <michaelni@gmx.at>
Thu, 12 Mar 2015 17:03:49 +0000 (18:03 +0100)
This could overflow and crash at least on 32 bit systems.

Reviewed-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b737a2c52857b214be246ff615c6293730033cfa)

Conflicts:

libavformat/mpc8.c
(cherry picked from commit 49dd89f9027f3def12e170bb7d986d37812eedba)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
libavformat/mpc8.c

index b448c1b..6499fca 100644 (file)
@@ -89,7 +89,7 @@ static int mpc8_probe(AVProbeData *p)
         size = bs_get_v(&bs);
         if (size < 2)
             return 0;
-        if (bs + size - 2 >= bs_end)
+        if (size >= bs_end - bs + 2)
             return AVPROBE_SCORE_MAX / 4 - 1; //seems to be valid MPC but no header yet
         if (header_found) {
             if (size < 11 || size > 28)