Fix a crash due to wrong pointer-integer arithmetic.

[Basically, the condition "src - dist < data" can be wrongly evaluated
to be false if "src < dist" due to underflow. Instead, "src - data <
dist" is the correct condition, as "src > data" is always true and so
there would never be an underflow].

Change-Id: Ic9f64bfe76a9acae97abc1fb7c1f4868e81f1eb8

src/dec/vp8l.c

@@ -596,10 +596,12 @@ static int DecodeImageData(VP8LDecoder* const dec,
       const int length_sym = code - NUM_LITERAL_CODES;
       const int length = GetCopyLength(length_sym, br);
       const int dist_symbol = ReadSymbol(&htree_group->htrees_[DIST], br);
+      // TODO(urvang): Evaluate if we should check 'dist_symbol', 'dist_code'
+      // and/or 'dist' to be valid.
       VP8LFillBitWindow(br);
       dist_code = GetCopyDistance(dist_symbol, br);
       dist = PlaneCodeToDistance(width, dist_code);
-      if (src - dist < data || src + length > src_end) {
+      if (src - data < dist || src_end - src < length) {
         ok = 0;
         goto Error;
       }