generic-library/ffmpeg
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

avformat/mpc8: fix broken pointer math

Browse Source 
This could overflow and crash at least on 32 bit systems.

Reviewed-by: Reimar Döffinger <Reimar.Doeffinger@gmx.de>
Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
(cherry picked from commit b737a2c528)

Conflicts:

	libavformat/mpc8.c
(cherry picked from commit 49dd89f902)

Signed-off-by: Michael Niedermayer <michaelni@gmx.at>
This commit is contained in:
wm4
2015-02-03 19:04:11 +01:00
committed by Michael Niedermayer
parent 5601f216bf
commit 21ebfcdd43
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
libavformat/mpc8.c
View File

@@ -91,7 +91,7 @@ static int mpc8_probe(AVProbeData *p)
size = bs_get_v(&bs); size = bs_get_v(&bs);
if (size < 2) if (size < 2)
return 0; return 0;
if (bs + size - 2 >= bs_end) if (size >= bs_end - bs + 2)
return AVPROBE_SCORE_MAX / 4 - 1; //seems to be valid MPC but no header yet return AVPROBE_SCORE_MAX / 4 - 1; //seems to be valid MPC but no header yet
if (header_found) { if (header_found) {
if (size < 11 || size > 28) if (size < 11 || size > 28)