[FFmpeg-cvslog] avcodec/dvbsub_parser: Fix potential pointer overflows

[Michael Niedermayer]

ffmpeg | branch: master | Michael Niedermayer <michaelni at gmx.at> | Sun Mar 15 18:20:58 2015 +0100| [de41d5372faa4ad7ad439e71975fc6f4ea0c0efc] | committer: Michael Niedermayer

avcodec/dvbsub_parser: Fix potential pointer overflows

Signed-off-by: Michael Niedermayer <michaelni at gmx.at>

> http://git.videolan.org/gitweb.cgi/ffmpeg.git/?a=commit;h=de41d5372faa4ad7ad439e71975fc6f4ea0c0efc
---

 libavcodec/dvbsub_parser.c |    6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/libavcodec/dvbsub_parser.c b/libavcodec/dvbsub_parser.c
index d15c891..f9fdb6a 100644
--- a/libavcodec/dvbsub_parser.c
+++ b/libavcodec/dvbsub_parser.c
@@ -122,11 +122,11 @@ static int dvbsub_parse(AVCodecParserContext *s,
     {
         if (*p == 0x0f)
         {
-            if (p + 6 <= p_end)
+            if (6 <= p_end - p)
             {
                 len = AV_RB16(p + 4);
 
-                if (p + len + 6 <= p_end)
+                if (len + 6 <= p_end - p)
                 {
                     *poutbuf_size += len + 6;
 
@@ -136,7 +136,7 @@ static int dvbsub_parse(AVCodecParserContext *s,
             } else
                 break;
         } else if (*p == 0xff) {
-            if (p + 1 < p_end)
+            if (1 < p_end - p)
             {
                 av_dlog(avctx, "Junk at end of packet\n");
             }